Post

Turns out those Unicode dashes are actually useful. Filter blocks "-"? Send full-width "－" instead. Windows converts it back to "-" inside curl.exe, injecting a -o argument that drops a webshell.