Manually Bypassing the Client-Side Validation leading to Command Injection

The first text box limits us to numbers only. But even when we change the input type to accept text instead of numbers, we're still stuck because the second box only lets us type 3 characters maximum. We can't type longer commands because of this length limit.

This is a helpful observation since it shows there are two separate restrictions working together to limit what we can input.

First, changing the input type to “number” and maxlength attribute to 100 (or another value).

Next, If the application takes the input and passes it to a system shell without proper sanitization, ";ls;" could execute the "ls" command, listing directory contents. The intention is to see if "flag.txt" exists in the current directory.

Yes the directory does exist now what? how to view the content in the flag.txt?