How to Execute Blacklisted Commands Without Typing Their Names

The filter checks for the string whoami in your input. Fine. You will execute whoami without the string whoami appearing anywhere in your payload. The shell is perfectly happy to run a command assembled from parts, reversed strings, or quoted fragments. The blacklist is not.

Technique one: quote insertion

Bash ignores single quotes and double quotes inserted within a command word, as long as they are balanced. The shell strips them during parsing and executes the underlying command. The blacklist sees w'h'o'am'i. The shell sees whoami.

Two rules: do not mix quote types within the same word, and keep the count even. w'h'o"am"i will break. w'h'o'am'i works. This technique also works on Windows CMD and PowerShell, making it cross-platform.

Technique two: backslash and positional parameters (Linux)

The backslash character and the $@ positional parameter are also stripped by bash during parsing. Unlike quotes, you do not need an even count. A single backslash anywhere in the word is enough to break the pattern.

Technique three: caret insertion (Windows)

The caret is the escape character in CMD. When placed before a regular character, it is consumed during parsing and the character passes through unchanged. The blacklist sees who^ami. CMD sees whoami.

Putting it together in a payload

Combine your operator bypass (newline), your space bypass (tab), and your command obfuscation (quote insertion) into a single payload. The filter sees no semicolons, no spaces, and no recognizable command names. The shell sees a perfectly valid command chain.

Basic obfuscation handled. But what if the filter is smarter? What if it catches quote patterns or runs case-insensitive matching? The next module goes deeper: reversed commands, base64 encoding, and automated obfuscation tools that generate payloads no static blacklist can anticipate.