Blacklist Bypass

Scenario

Suppose the commands cat flag can read the flag but both strings cat and flag are blacklisted.

Method 1: Variable Concatenation

a=c;b=at;c=fl;d=ag;$a$b ${c}${d}

Method 2: Wildcards

cat fl*