A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Three years ago I was testing a healthcare portal. Every injection attempt returned "Invalid input." The developer had added a blacklist. My job was not to give up. My job was to figure out exactly which characters triggered the block, one by one, until I found a gap. That gap was a newline character. Took me eleven minutes.
You know 127.0.0.1 works. You know 127.0.0.1; whoami does not. The payload contains three new elements beyond the valid IP: a semicolon, a space, and the word whoami. Test each one in isolation. Add only the semicolon. Does it block? Add only a space. Does it block? You are performing a binary search on the filter's blacklist.
Semicolon is blacklisted. Newline is not. That is your injection operator. You just eliminated one variable. Now test the space character.
Space is blacklisted too. Two characters down. You have a working operator (newline) but cannot use spaces. The next lesson covers exactly how to replace spaces with tabs, ${IFS}, or brace expansion. But first, finish mapping the filter.
Pay attention to how the rejection appears. If the error message shows up in the same response body, in the same page layout, it is likely the application's own PHP or Node code rejecting the input. If you get a completely different page with your IP address, a request ID, or branding like "Blocked by Cloudflare" or "Access Denied - ModSecurity," you are hitting an external WAF. The bypass strategies differ.
Application-level blacklists are usually short and predictable. WAF rulesets are broader but often have known bypasses documented in public research. Identify which layer is blocking you before choosing your evasion strategy.
Tab (%09) bypasses the space filter. The id command works. But whoami is blocked. The blacklist contains specific command names. You now have a complete picture: semicolons blocked, spaces blocked, certain commands blocked. Newline and tab are your friends. Command obfuscation is your next move.
You have mapped the filter. You know what is blocked and what is not. Now you exploit the gaps. The next two lessons are pure bypass technique: replacing spaces, producing slashes from environment variables, and obfuscating command names until the blacklist cannot recognize them.
Finish the lesson once you have worked through the material. This awards ★ 40 XP.