Every Shell Operator You Can Use to Chain Injected Commands

You do not need to memorize twenty operators. You need to understand five, know their URL-encoded forms, and understand when each one executes the second command. The rest is variation on a theme.

The operators and their execution logic

Semicolon: the blunt instrument

Semicolon does not care whether the first command succeeded or failed. Both run, period. The only caveat: Windows CMD does not recognize semicolons as command separators. PowerShell does. If you are targeting a Windows backend and semicolons fail, try newline or AND.

Newline: the universal separator

In an HTTP request, you send the newline as %0a in the POST body or query string. It is the most reliable operator because almost no filter blacklists newlines. The input might legitimately need them.

OR operator: when you want to break the first command

This is useful when your injection breaks the original command syntax. Supply no valid IP, let ping fail with a usage error, and your injected command runs cleanly. The output is just your command result. No ping noise. Cleaner exploitation.

Five operators. Five URL encodings. That is your entire toolkit for basic command injection. The next lesson shows you what happens when the application says "no" before your payload ever reaches the server.