Using Case Manipulation and String Reversal to Evade Command Filters

Some blacklists are case-sensitive. They check for whoami but not WHOAMI or WhOaMi. On Windows, this is a free bypass because CMD and PowerShell are case-insensitive. On Linux, bash is case-sensitive, so you need a conversion step. Both scenarios are exploitable.

Windows: just change the case

That is it. The blacklist looks for the lowercase string whoami. You send WhOaMi. CMD does not care. Command executes. If you are targeting a Windows backend and the filter is case-sensitive, this is your first attempt. It works more often than it should.

Linux: convert case at runtime with tr

Linux bash will not execute WhOaMi as a command. It will return command not found. But you can pipe the mixed-case string through tr to convert it to lowercase, then execute the result in a sub-shell.

The tr command translates uppercase to lowercase. The <<< here-string feeds WhOaMi into tr. The $() sub-shell captures the output (whoami) and executes it. The blacklist never sees the lowercase string in your payload.

Alternative: printf with bash lowercase expansion

The ${a,,} syntax is bash 4+ parameter expansion that lowercases the entire variable. No external commands needed. Shorter payload. Fewer characters to filter.

Reversed commands: write it backwards, execute it forwards

Instead of writing whoami, write imaohw. Then use the rev command in a sub-shell to reverse it back at execution time. The blacklist sees imaohw. The shell executes whoami.

Generate the reversed string locally first with echo 'whoami' | rev, then embed the reversed version in your payload. The rev command is available on virtually all Linux distributions.

Windows PowerShell reversal

PowerShell treats strings as character arrays. The [-1..-20] slice reverses the array. -join '' concatenates it back. iex (Invoke-Expression) executes the result. The blacklist sees imaohw. PowerShell runs whoami.

Case manipulation and reversal are manual techniques. They work, but they require you to craft each payload by hand. When you are up against a WAF with hundreds of rules, you need automation. The next two lessons cover base64 encoding and Bashfuscator, which generates payloads that no static signature can match.