Tags: waf web rce php waf-bypass 

Rating: 5.0

* use commas to string concatenate
* echo expressions with parentheses
* additional whitespace
* octal dump flag

Original writeup (https://rainbowpigeon.netlify.app/posts/zh3r0ctf-2021/#strpos-and-substr).