dd can be used for bypassing character restrictions

A cool little trick I learned for the CPTS, but in general for bash (or shells in general? not sure).

If a web app filters specific characters, a usual escape is ${IFS} for whitespace, %0a for newlines or in place of ;, ${PATH:0:1} for / and so on.

However, some characters are difficult to get reliably, like | or &.

If you have access to the place which defines the blocklist, then you can use dd to grab the exact byte from that file where it is defined as illegal.

It’s useless on the following oneliner example because you might as well use cut then, but if you have a multiline file, the character you need is defined on L77, and you don’t have access to grep or any way to parse lines, you can just use dd!

Simplified example with file called text.txt:

asdf&

You access the last character using:

dd status=none if=text.txt bs=1 skip=4 count=1

status=none is optional, this is for Macs only, Linux doesn’t need that.

The only issue is that & is parsed as a command by the shell, so if you just do this:

somecommand $(dd ...) ...

…it won’t work.

You need to eval it, like so:

eval "cat text.txt $(dd status=none if=text.txt bs=1 skip=4 count=1)$(dd status=none if=text.txt bs=1 skip=4 count=1) echo yeah"

And that is functionally equivalent to:

cat text.txt && echo yeah