I am testing a PHP webapp that provides a ping function. I have tried different command injection methods and found that it accepts only
%0a with simple command injection like
However the code is filtering many characters such as
| & ; ( " / > ’ which are required to execute a reverse shell. Like
nc -e /bin/bash.
Any suggestions on how to bypass this filter?