I am attempting to educate myself further on web securities using DVWA. I am stumped on Command Injection, on the high level
The help states
The developer has either made a slight typo with the filters and believes a certain PHP command will save them from this mistake.
trim() removes all leading & trailing spaces, right?.
They don't render correctly on here but there are three tab spaces between trim() and removes. Having said this, the trim() function removes tabbed spaces. It does apparently struggle with non-breaking spaces though (\xA0). I'm not hugely familiar with command lines but note from the source code all the symbols I would try and inject with are replaced with PHP before you can get them to do anything.
Please note - previous sources on the net say this level is uncrackable but I am using v1.9, released 2015-10-05, with the changelog noting
Renamed 'high' level to 'impossible' and created new vectors for 'high'.
So effectively this is a new challenge.
I'm running on Windows, bearing in mind this has an affect on command syntax etc. Other (older) answers point to using named pipes (FIFO) which are apparently easier on *nix systems.