Search code examples
bashsecuritycode-injectionquoting

How can i bypass a if instruction by injecting a variable


How can I bypass this instruction

if test $TEST -eq ${1} 2>/dev/null; then

by injecting code? I tried some injection when I run the script like:

./script.sh '1 || 1 = 1 '

It doesn't work.


Solution

  • Use -o instead of ||, you want test to interpret the value of the variable, not the shell.

    ./script.sh '1 -o 1 = 1'