Bypassing Space and Slash Filters Using Environment Variables and Tabs

Spaces are the most commonly blacklisted character in command injection filters. The reasoning is simple: if the input should be an IP address, it should never contain a space. But the Linux shell does not actually require space characters between arguments. It requires word separators. And there are several alternatives.

Bypass one: tab characters

The shell treats tabs identically to spaces as argument delimiters. If spaces are blocked but tabs are not, replace every %20 with %09. The command executes exactly the same way.

Bypass two: the ${IFS} variable

IFS stands for Internal Field Separator. Its default value in bash is a space, a tab, and a newline. When you write ${IFS} in a command, the shell expands it to those whitespace characters. The filter sees the literal string dollar-brace-IFS-brace. The shell sees a space.

Bypass three: brace expansion

Bash brace expansion automatically inserts spaces between comma-separated items inside curly braces. The command {ls,-la} expands to ls -la without you typing a single space character.

In your injection payload, this becomes 127.0.0.1%0a{ls,-la}. No spaces anywhere. The shell handles the expansion.

Producing slashes from environment variables

Forward slashes are often blacklisted because they appear in file paths. But the $PATH variable on Linux contains multiple slashes. You can extract a single slash using substring syntax: ${PATH:0:1} gives you the first character of $PATH, which is always a forward slash.

You can do the same with $HOME or $PWD. For a semicolon, look at $LS_COLORS. The character at position 10 is typically a semicolon. Use ${LS_COLORS:10:1} to extract it. Now you have an injection operator without typing a literal semicolon.

Windows equivalent: substring extraction from variables

Spaces and slashes are handled. But the filter also blocks command names. If whoami is blacklisted, you need to make the shell execute whoami without the string whoami ever appearing in your payload. That is command obfuscation, and it is where creativity becomes a technical skill.