search

Filters

hashtag
Front-End Validation

If the restrictions are only applied on the client-side (Figure 1.1), we can bypassed them by using a proxy and modifying the request before it reaches the server (Figure 1.2).

Figure 1: Bypassing frontend validation.

hashtag
Application Filters/WAFs

If an error message is displayed where the output should be (Figure 2), then the filter exists in the application itself, whereas if it is displayed on another page, it indicates the presence of a WAF.

Figure 2: An application filter blocking our command injection attempt.

We should first try to identify what is blocked. It could be a character (;), command (id), or both (;id). We can find out with some trial and error:

  1. 127.0.0.1; -> ❌ (; is blocked)

  2. Replacing ; with & -> Works ✅

  3. 127.0.0.1&id -> ❌ (id is blocked)

  4. Try the methods below!

hashtag
Blacklisted Characters

hashtag
Environment Variables

Below there are some common blacklisted characters in Linux and their potential alternatives.

Blocked
Alternative(s)

+

%09 (tab)

${IFS}

{cmd,flag} (brace expansion)

/

${PATH:0:1}

;

${LS_COLORS:10:1}

:

${LS_COLORS:4:1}

hashtag
Character Shifting

We can shift the character by 1, so when we can pass the ASCII character before the one we need. We can get the ASCII table using man ascii. For instance if we need to use the + symbol, we would use the * that comes after it.

hashtag
Globbing

Using wildcards (?, *, [, ], !) to partially or fully match file names or other file content. Globbing can be hepful in the case where applications/WAFs restrict the use of certain characters.

hashtag
Blacklisted Commands

hashtag
Casing

hashtag
Reversing

hashtag
Encoding

Encoding the payload can be useful for simple pattern-matching evasion. For instance, regex patterns will have a hard time identifying bash commands in the encoded string. This is also useful if the server URL-encodes certain characters.

We can also combine Base64-encoding with command substitution (``).

hashtag
Input Sanitization

  • Single or double quotes can be used to obfuscate a command as they are ignored by both Bash and PowerShell. CMD only ignores double quotes. The quote type cannot be mixed and must always be an even number.

  • In Linux we can use command substitution ($() or ``) to inject empty output between characters, thereby modifying strings without altering the functional behavior of the payload.

hashtag
Input Normalization

We must make sure to handle "bad" characters that might alter a payload’s behavior. We should enclose such characters in single quotes to make the target server interpret them as valid data instead of new parameters.

We also need to URL-encode these characters. For instance, the & character is used as a delimiter by the backend, and if not URL-encoded, the web server will process everything after it as a parameter-value pair.

PreviousExamplesNexthappy-dom

Last updated

Was this helpful?