Merge pull request #236 from AikidoSec/decode-url-strings

Don't skip whoami%00

Author: teta2k

Aikido.Zen.Core/Vulnerabilities/ShellInjectionDetector.cs

@@ -81,8 +81,9 @@ private static bool ContainsShellSyntax(string command, string userInput)
             // Check if the command contains a commonly used command
             foreach (Match match in commandsRegex.Matches(command))
             {
-                if (userInput != match.Value)
+                if (!userInput.Contains(match.Value))
                 {
+                    // Don't skip whoami%00
                     continue;
                 }