Has someone done this level? I get that i'm supposed to bypass the trim function, but i don't see how could this be done if every relevant character has been blacklisted except for the redirection (>). There's a similar question posted here but the answers didn't help, they where just hints.

This is what the help states:

The developer has either made a slight typo with the filters and believes a certain PHP command will save them from this mistake.

Spoiler: trim() removes all leading & trailing spaces, right?.


  • wasn't DVWA high level not vulnerable at all? Unless you find some new vulnerability...
    – user15194
    Jun 8, 2016 at 12:51

2 Answers 2


Looking at the code (https://github.com/RandomStorm/DVWA/blob/master/vulnerabilities/exec/source/high.php) it is definately vulnerable. You just need to take a look at what trim does and what characters are both whitespace and have special meaning on the command line.



The high security options are supposed to be the proper implementation. So they are NOT exploitable, except you find a new one.

  • The old high is now "impossible" and it can be exploited if the server hosting it is vulnerable to shellshock but seems solid otherwise
    – wireghoul
    Jun 8, 2016 at 13:20

Not the answer you're looking for? Browse other questions tagged .