webeasy
Echo v2
spbctf
Task: Echo server with WAF blocking backticks, semicolons, pipes, and &&. Solution: Use $() command substitution syntax which was not blocked to read /flag.
$ ls tags/ techniques/
command_substitution_bypassdollar_parenthesis_injection
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub, then upgrade to Pro.
$ssh [email protected]