Identifying Filters

When a payload returns “Invalid input,” a filter or blacklist is in play. Identifying which character or command triggered the block is the first step to bypassing it.

Filter vs. WAF

• App-layer filter (e.g., PHP): “Invalid input” appears inline in the response body. A PHP blacklist looks like:

$blacklist = ['&', '|', ';', ...];
foreach ($blacklist as $character) {
    if (strpos($_POST['ip'], $character) !== false) {
        echo "Invalid input";
    }
}

• WAF block: A separate error page containing details like the requester’s IP, typically indicating a network-layer device blocked the request.

Isolating the blocked character

Strip the payload down to one character at a time. Start with a known-good value and add a single suspected character, then send. Repeat until the response changes to “Invalid input.”

Example progression:

1. 127.0.0.1 → OK
2. 127.0.0.1; → Invalid input → ; is blacklisted

Test each injection operator (;, &&, ||, &, |, \n) individually to map out what the blacklist covers. This determines which bypass techniques to apply next.