很早之前在blog中就记录过一篇文章:Linux Shell中的特殊字符,但觉得总结得还不够——不够直接,所以后来又去网上搜了搜,还真是找到了不少相关内容,之前知道的还是太少了o(╯□╰)o 学无止境,慢慢来吧……
搜索关键字:
- http://search.aol.com/aol/search?q=special+character+in+bash
- http://search.aol.com/aol/search?q=special+characters+list+in+bash
- http://search.aol.com/aol/search?q=special+characters+in+unix+bash+shell
参考链接:
- [Chapter 8] 8.19 “Special” Characters and Operators
- Meta-characters and Filename expansion
Bash Reference Manual - BashGuide/SpecialCharacters – Greg’s Wiki #这个wiki挺牛逼的!
- Special Characters #官方说明!
- Internal Commands and Builtins #Bash的内建命令
- A Brief Introduction to Regular Expressions #Bash中的正则表达式
相关链接:
- shell – Which characters need to be escaped in Bash? How do we know it? – Stack Overflow
- http://www.commandlinefu.com/commands/view/4589/command-to-show-a-list-of-special-characters-for-bash-prompt-ps1
- http://javarevisited.blogspot.com/2011/06/special-bash-parameters-in-script-linux.html
- using special symbols in bash script
Special characters
A group of characters have been exempted, that when we use them, they are evaluated by Bash to have a non-literal meaning. Instead, these characters carry out a special instruction, or have an alternate meaning; they are called “special characters“, or “meta-characters“.
To explain the special characters in all the cases in which they may be used, read the section on the TLDP guide. Here are some of the more common special characters uses:
Char. | Description |
” “ | Whitespace — this is a tab, newline, vertical tab, form feed, carriage return, or space. Bash uses whitespace to determine where words begin and end. The first word is the command name and additional words become arguments to that command. |
$ | Expansion — introduces various types of expansion: parameter expansion (e.g. $var or ${var}), command substitution (e.g. $(command)), or arithmetic expansion (e.g. $((expression))). More on expansions later. |
” | Single quotes — protect the text inside them so that it has a literal meaning. With them, generally any kind of interpretation by Bash is ignored: special characters are passed over and multiple words are prevented from being split. |
“” | Double quotes — protect the text inside them from being split into multiple words or arguments, yet allow substitutions to occur; the meaning of most other special characters is usually prevented. |
\ | Escape — (backslash) prevents the next character from being interpreted as a special character. This works outside of quoting, inside double quotes, and generally ignored in single quotes. |
# | Comment — an introduction of a # character begins a commentary that extends to the end of the line. Comments are notes of explanation and are not processed by the shell. |
[[]] | Test — an evaluation of a conditional expression to determine whether it is “true” or “false”. Tests are used in Bash to evaluate a number of conditions. More of this will be covered later. |
! | Negate — used to negate or reverse a test or exit status. For example: ! grep text file; exit $?. |
>< | Redirection — redirect a command’s output or input. Redirections will be covered later. |
| | Pipe — redirect output from a initial command to the input of secondary command. This is a method of chaining commands together. Example: echo “Hello beautiful.” | grep -o beautiful. |
; | Command separator — a representation of a newline. Used to separate multiple commands that are on the same line. |
{} | Inline group — commands inside the curly braces are treated as if they were one command. It is convenient to use these when Bash syntax requires only one command and a function doesn’t feel warranted. |
() | Subshell group — similar to the above but where commands within are executed in subshell. Used much like a sandbox, if a command causes side effects (like changing variables), it will have no effect on the current shell. |
(()) | Arithmetic expression — with an arithmetic expression, characters such as +, -, *, and / are mathematical operators used for calculations. They can be used for variable assignments like (( a = 1 + 4 )) as well as tests like if (( a < b )). More on this later. |
$(()) | Arithmetic expansion — Comparable to the above, but the expression is replaced with the result of its arithmetic evaluation. Example: echo “The average is $(( (a+b)/2 ))”. |
~ | Home directory — the tilde is a representation of the home directory. When followed by a /, it means the current user’s home directory; otherwise, a username will have to be specified (e.g.ls ~/Documents; cp ~john/.bashrc .). |
Examples:
$ echo "I am $LOGNAME" I am lhunath $ echo 'I am $LOGNAME' I am $LOGNAME $ # boo $ echo An open\ \ \ space An open space $ echo "My computer is $(hostname)" My computer is Lyndir $ echo boo > file $ echo $(( 5 + 5 )) 10 $ (( 5 > 0 )) && echo "Five is greater than zero." Five is greater than zero.
Additionally:
In The Manual — Shell Syntax
Special Characters — Characters that have a special meaning to Bash. Usually their meaning is interpreted and then they are removed from the command before executing it.
最后来张从网上找到的表格,更加直观的显示出shell(虽然是csh和sh的,但Bash也大体相同,只有少许差异)中的特殊字符:
Table 8.3 is a table of special characters and operators in the C shell ( csh ) and Bourne shell ( sh ). The chart also includes several combinations of characters just to be complete. As in other parts of this book, the sh entries apply to ksh and bash ; the csh entries apply to tcsh .
List of Special Characters and Their Meanings |
|||
Character | Where | Meaning | Article |
ESC | csh | Filename completion. | 9.8 |
RETURN | csh, sh | Execute command. | 41.2 |
space | csh, sh | Argument separator. | 8.5 |
TAB | csh, sh | Argument separator. | 8.5 |
TAB | bash | Filename completion. | 9.8 |
# | csh, sh | Start a comment. | 44.2 |
` | csh, sh | Command substitution (backquotes). | 9.16 |
“ | sh | Weak quotes. | 8.14 |
“ | csh | Weak quotes. | 8.15 , 8.14 |
‘ | sh | Strong quotes. | 8.14 |
‘ | csh | Strong quotes. | 8.15 , 8.14 See \. |
\ | sh | Single-character quote. | 8.14 |
\ | csh | Single-character quote. | 8.15 , 8.14 |
$ var | csh, sh | Variable. | 6.1 , 6.8 |
${ var } | csh, sh | Same as $ var . | 6.8 |
$ var : mod | csh | Edit var with modifier mod | 9.6 |
${ var – default } | sh | If var not set, use default . | 45.12 |
${ var = default } | sh | If var not set, set it to default and use that value. | 45.12 |
${ var + instead } | sh | If var set, use instead . Otherwise, null string. | 45.12 |
${ var ? message } | sh | If var not set, print message (else default). If var set, use its value. | 45.12 |
${ var # pat } | ksh, bash | Value of var with smallest pat deleted from start. | 9.7 |
${ var ## pat } | ksh, bash | Value of var with largest pat deleted from start. | 9.7 |
${ var % pat } | ksh, bash | Value of var with smallest pat deleted from end. | 9.7 |
${ var %% pat } | ksh, bash | Value of var with largest pat deleted from end. | 9.7 |
| | csh, sh | Pipe standard output. | 1.4 , 13.1 |
|& | csh | Pipe standard output and standard error. | 13.5 |
^ | sh only | Pipe character (obsolete). | |
^ | csh, bash | Edit previous command line. | 11.5 |
& | csh, sh | Run program in background. | 1.27 , 1.28 |
? | csh, sh | Match one character. | 1.16 , 15.2 |
* | csh, sh | Match zero or more characters. | 1.16 , 15.2 |
; | csh, sh | Command separator. | 8.5 |
;; | sh | End of case statement. | 44.5 |
~ | csh, ksh, bash | Home directory. | 14.11 |
~ user | csh, ksh, bash | Home directory of user . | 14.11 |
! | csh, bash | Command history. | 11.2 |
– | Programs | Start of optional argument. | 8.5 |
– | Programs | Read standard input. (Only certain programs.) | 13.13 |
$# | csh, sh | Number of arguments to script. | 44.15 |
“$@” | sh | Original arguments to script. | 44.15 |
$* | csh, sh | Arguments to script. | 44.15 |
$- | sh | Flags set in shell. | 2.11 |
$? | sh | Status of previous command. | 44.7 |
$$ | csh, sh | Process identification number. | 8.14 |
$! | sh | Process identification number of last background job. | 7.12 |
$< | csh | Read input from terminal. | 9.11 |
cmd1 && cmd2 | csh, sh | Execute cmd2 if cmd1 succeeds. | 44.9 |
cmd1 || cmd2 | csh, sh | Execute cmd2 if cmd1 fails. | 44.9 |
$(..) | ksh, bash | Command substitution. | 45.31 , 9.16 |
((..)) | ksh, bash | Arithmetic evaluation. | |
\. file | sh | Execute commands from file in this shell. | 44.23 |
: | sh | Evaluate arguments, return true. | 45.9 |
: | sh | Separate values in paths. | 6.4 , 14.5 , 21.8 |
: | csh | Variable modifier. | 9.6 |
[] | csh, sh | Match range of characters. | 1.16 , 15.2 |
[] | sh | Test. | 44.20 |
% job | csh, ksh, bash | Identify job number. | 12.1 |
( cmd ; cmd ) | csh, sh | Run cmd ; cmd in a subshell. | 13.7 |
{} | csh, bash | In-line expansions. | 9.5 |
{ cmd ; cmd ; } | sh | Like ( cmd ; cmd ) without a subshell. | 13.8 |
> file | csh, sh | Redirect standard output. | 13.1 |
>> file | csh, sh | Append standard output. | 13.1 |
< file | csh, sh | Redirect standard input. | 13.1 |
<< word | csh, sh | Read until word , do command and variable substitution. | 8.18 , 9.14 |
<<\ word | csh, sh | Read until word , no substitution. | 8.18 |
<<- word | sh | Read until word , ignoring leading TABs. | 8.18 |
>>! file | csh | Append to file , even if noclobber set and file doesn’t exist. | 13.6 |
>! file | csh | Output to file , even if noclobber set and file exists. | 13.6 |
>| file | ksh, bash | Output to file , even if noclobber set and file exists. | 13.6 |
>& file | csh | Redirect standard output and standard error to file . | 13.5 |
m > file | sh | Redirect output file descriptor m to file . | 45.21 |
m >> file | sh | Append output file descriptor m to file . | |
m < file | sh | Redirect input file descriptor m from file . | |
<& m | sh | Take standard input from file descriptor m . | |
<&- | sh | Close standard input. | 45.10 |
>& m | sh | Use file descriptor m as standard output. | 45.21 |
>&- | sh | Close standard output. | 45.21 |
m <& n | sh | Connect input file descriptor n to file descriptor m . | 45.22 |
m <&- | sh | Close input file descriptor m . | 45.21 |
n >& m | sh | Connect output file descriptor n to file descriptor m . | 45.21 |
m >&- | sh | Close output file descriptor m . | 45.21 |
《 “Bash中的特殊字符” 》 有 6 条评论
【技术分享】命令执行和绕过的一些小技巧
http://bobao.360.cn/learning/detail/3192.html
Guide to Bash Injection
https://hacked.com/wiki/Guide_to_Bash_Injection
Linux&bash闯关CTF
https://mp.weixin.qq.com/s/8jlry-AVOocN2M6n425rIg
命令注入(Command Injection)
https://www.owasp.org/index.php/Command_Injection
Linux Bash 小特性(命令绕过)
https://www.bodkin.ren/?p=808
【命令执行】绕过姿势总结
http://vinc.top/2016/12/22/%E3%80%90%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E3%80%91%E7%BB%95%E8%BF%87%E5%A7%BF%E5%8A%BF%E6%80%BB%E7%BB%93/
【技术分享】命令执行和绕过的一些小技巧
http://bobao.360.cn/learning/detail/3192.html
浅谈CTF中命令执行与绕过的小技巧
http://www.freebuf.com/articles/web/137923.html
命令执行限制绕过
http://rcoil.cc/2017/01/%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E9%99%90%E5%88%B6%E7%BB%95%E8%BF%87/
远程代码执行漏洞总结
http://byd.dropsec.xyz/2016/07/23/%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E6%80%BB%E7%BB%93/
RCE Bypass 远程命令执行绕过技巧
http://www.leommxj.com/2017/06/11/RCE-Bypass/
任意系统命令执行
http://nouername.github.io/2016/07/23/%E4%BB%BB%E6%84%8F%E7%B3%BB%E7%BB%9F%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C/
命令执行不能使用空格绕过
http://www.cnblogs.com/sevck/p/5670948.html
为初学者建立的包含大量 CTF 赛题的网站
https://twitter.com/matalaz/status/1080776104544268288
巧用命令注入的N种方式 #篇幅很长,但确实很经典、全面
https://mp.weixin.qq.com/s/Hm6TiLHiAygrJr-MGRq9Mw
命令注入新玩法:巧借环境攻击目标
https://www.freebuf.com/articles/web/194574.html
Bash代码审计Case
https://mp.weixin.qq.com/s/9KMiqRNpHDjmuS7ynLTTIQ