> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfnote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfnote/web/os-command-injection/blacklist-bypass.md).

# Blacklist Bypass

## Scenario

Suppose the commands `cat flag` can read the flag but both strings `cat` and `flag` are blacklisted.

## Method 1: Variable Concatenation

```bash
a=c;b=at;c=fl;d=ag;$a$b ${c}${d}
```

## Method 2: Wildcards

```bash
cat fl*
```