Cloud Shell

Execute commands on ECS instance i-2zeb5k1p7m (production-web-01). WAF rules are active.

Command Configuration

Command

Enter a command to execute on the instance via Cloud Shell

Blocked by WAF (cat)

WAF Bypass 🧙‍♂️

Terminal Output i-2zeb5k1p7m

Enter a command and click Execute

Try: tac /etc/hosts or head -n 5 /etc/passwd

🧙‍♂️ Aliyun WAF Bypass — Real-World Finding

The Finding: Aliyun WAF (Web Application Firewall) blocks the cat command because it's a common vector for Local File Inclusion (LFI) and Remote Code Execution (RCE) attacks. However, the WAF rule only checks for the literal cat keyword — it doesn't account for alternative file-reading commands available on Linux/Unix systems.

🧙‍♂️ The Bypass: Commands like tac (reverse of cat), head, tail, nl (number lines), rev (reverse characters), and more/ less can all read file contents but are not blocked by the WAF ruleset.

Command	Result	Notes
cat /etc/hosts	🚫 BLOCKED	Triggers WAF Rule #1024
tac /etc/hosts	✅ BYPASS	Prints file in reverse line order
head /etc/passwd	✅ BYPASS	Prints first 10 lines by default
tail /etc/hosts	✅ BYPASS	Prints last 10 lines by default
nl /etc/passwd	✅ BYPASS	Prints line numbers before file content
rev /etc/hosts	✅ BYPASS	Reverses each line's characters
more /etc/passwd	✅ BYPASS	Pager — prints file one screen at a time