Tags: waf web rce php waf-bypass 

Rating: 5.0

  • use commas to string concatenate
  • echo expressions with parentheses
  • additional whitespace
  • octal dump flag
Original writeup (https://rainbowpigeon.netlify.app/posts/zh3r0ctf-2021/#strpos-and-substr).