{"id":22804356,"url":"https://github.com/divinemonk/os-injection-concatenator","last_synced_at":"2026-05-09T04:33:32.091Z","repository":{"id":171051885,"uuid":"647365759","full_name":"Divinemonk/os-injection-concatenator","owner":"Divinemonk","description":"OS Injection Command Concatenator: cheatsheet","archived":false,"fork":false,"pushed_at":"2023-05-30T17:15:08.000Z","size":16,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"m41n","last_synced_at":"2025-03-30T20:30:17.750Z","etag":null,"topics":["cheatsheet","command-line","concatenate","concatenation","cyber","cybersecurity","injection-attacks","linux","linux-commands","os-injection","terminal","windows"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Divinemonk.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-05-30T16:11:17.000Z","updated_at":"2023-05-30T17:05:07.000Z","dependencies_parsed_at":null,"dependency_job_id":"1c3931d2-4674-41e0-be96-337798e7af97","html_url":"https://github.com/Divinemonk/os-injection-concatenator","commit_stats":null,"previous_names":["divinemonk/os-injection-concatenator"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Divinemonk/os-injection-concatenator","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Divinemonk%2Fos-injection-concatenator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Divinemonk%2Fos-injection-concatenator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Divinemonk%2Fos-injection-concatenator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Divinemonk%2Fos-injection-concatenator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Divinemonk","download_url":"https://codeload.github.com/Divinemonk/os-injection-concatenator/tar.gz/refs/heads/m41n","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Divinemonk%2Fos-injection-concatenator/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32807255,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-08T08:22:46.396Z","status":"online","status_checked_at":"2026-05-09T02:00:06.633Z","response_time":123,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cheatsheet","command-line","concatenate","concatenation","cyber","cybersecurity","injection-attacks","linux","linux-commands","os-injection","terminal","windows"],"created_at":"2024-12-12T10:07:57.687Z","updated_at":"2026-05-09T04:33:32.084Z","avatar_url":"https://github.com/Divinemonk.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# OS Injection Command Concatenator Cheatsheet\n\n\u003e Linux \u0026amp; Windows special characters that can be use to concatenate system (terminal/commandline) commands\n\n- goto [use case](#use-case) / [main table](#special-characters-w-os-specific-description) / [prevention measures](#prevent-os-injection-vulnerabilities)\n\n\n\u003cbr\u003e\n\n# Use case\nIt's important to note that the use of special characters for command concatenation, as described earlier, is not directly related to OS injection vulnerabilities. OS injection vulnerabilities typically occur when untrusted input is passed to an operating system command without proper sanitization or validation.\n\nHowever, in some cases, the improper handling of special characters can lead to OS injection vulnerabilities. If user-supplied input is concatenated directly into a command without proper validation or escaping, an attacker may be able to inject additional commands or manipulate the execution flow. This can be especially risky when user input is combined with special characters used for command concatenation.\n\n\u003cbr\u003e\n\n## Special characters w/ os specific description\n\n| Special Character |\tUsage in Linux | Usage in Windows |\n|---|---|---|\n|`;`|\tExecutes multiple commands sequentially |\tExecutes multiple commands sequentially|\n|`\u0026\u0026`|\tExecutes the next command if the previous one succeeds | Executes the next command if the previous one succeeds|\n|`\\|\\|`|\tExecutes the next command if the previous one fails |\tExecutes the next command if the previous one fails|\n|`\u0026`| Executes a command in the background |\tExecutes a command in the background|\n|`\u003e`|\tRedirects output to a file | Redirects output to a file|\n|`\u003e\u003e`|\tAppends output to a file |\tAppends output to a file|\n|`\u003c`|\tRedirects input from a file |\tRedirects input from a file|\n|`2\u003e`|\tRedirects error output to a file |\tRedirects error output to a file|\n|`2\u003e\u003e`|\tAppends error output to a file |\tAppends error output to a file|\n|`\u0026\u003e`|\tRedirects both output and error output to a file |\tRedirects both output and error output to a file|\n|`\u0026\u0026`|\tUses conditional execution; executes the next command if the previous one succeeds|Uses conditional execution; executes the next command if the previous one succeeds|\n\n\u003cbr\u003e\n\n## Prevent OS injection vulnerabilities\n\u003e It's important to follow secure coding practices\n\n 1) __Input validation and sanitization__: Validate and sanitize all user input before using it in commands. This includes checking for malicious characters, removing or escaping special characters, and enforcing strict input formats.\n 2) __Parameterized queries__: If you're executing database queries or interacting with external systems, use parameterized queries or prepared statements instead of concatenating user input directly into the command. This helps prevent injection attacks by automatically handling escaping and quoting.\n 3) __Command whitelisting__: Maintain a whitelist of allowed commands or actions and validate user input against this whitelist. Only allow specific commands that are necessary for the application's intended functionality.\n 4) __Least privilege principle__: Ensure that the commands or processes executed have the minimal necessary privileges. Avoid running commands with elevated privileges unless absolutely required.\n 5) __Regular security updates__: Keep your operating system and software up to date with the latest security patches to protect against known vulnerabilities.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdivinemonk%2Fos-injection-concatenator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdivinemonk%2Fos-injection-concatenator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdivinemonk%2Fos-injection-concatenator/lists"}