Command Injection Bypasses

Command injection filters typically block spaces, slashes, and known command names. Each bypass technique targets a specific filter type. Start with the simplest and move to more complex only if the simpler ones fail. Always confirm baseline injection works first: if whoami executes cleanly, only apply bypasses when a filtered character or keyword blocks further progress.

Bypass techniques by filter type:

• Space filters: use %09 (tab), $IFS, or brace expansion {cmd,arg}
• Slash filters: extract / from ${PATH:0:1}
• Keyword blacklists: break commands with quotes, backslashes, or $@
• Full payload encoding: base64, hex (\x77), or octal (\167) encode the entire command
• Blind confirmation: use sleep delays or out-of-band callbacks when output is not reflected

Space Bypass

Most filters check for literal space (0x20) but miss alternative whitespace and shell expansion:

Slash Bypass

When / is blocked, reconstruct the path from environment variables:

${PATH:0:1} extracts the first character from $PATH, which is always / on a standard Linux system.

Command Injection Filter Bypass for Keyword Blacklists

Filters that match exact command strings miss these shell parsing tricks:

On Windows CMD, the caret ^ is an escape character and is ignored during execution:

Base64 Encoding

Encodes the entire command so no keywords or special characters appear in the request. The most reliable bypass for aggressive keyword filters:

Hex and Octal Encoding

Shell-level character encoding for when base64 itself is blocked:

Blind Injection Confirmation

When command output is not reflected in the response, confirm execution through timing or out-of-band callbacks:

Windows Bypass Techniques

Windows CMD and PowerShell have their own bypass primitives. These work when the target runs on Windows and Linux-style $IFS or ${PATH:0:1} tricks do not apply.

Caret Insertion

The caret (^) is CMD's escape character and is stripped during execution. Insert it anywhere in a blocked keyword to evade string matching:

Carets work between any characters in a command name or argument. Place multiple to break up longer blocked strings.

COMSPEC Substring Extraction

%COMSPEC% resolves to C:\WINDOWS\system32\cmd.exe. Use it directly when cmd is blocked as a keyword, or extract individual characters by position with %COMSPEC:~offset,length%:

%25COMSPEC%25 is URL-encoded %COMSPEC%. CMD expands it to the full cmd.exe path. For extracting specific characters: %COMSPEC:~2,1% gives \ (the backslash at position 2), useful when \ itself is filtered.

Variable Concatenation with set

Use set to build a command from fragments, then execute the combined variable. Keyword filters cannot match the final command because it only exists at runtime:

URL-decoded, the payload is set a=who&&set b=ami&&call %a%%b%. CMD sets two variables, then call expands and executes whoami.

FOR /F Loop Execution

FOR /F executes a command and captures its output. Useful when direct command invocation is blocked:

The FOR loop avoids direct command name matching. Combined with caret insertion on the inner command, it bypasses multi-layered keyword filters.