Labs Covered

This write-up focuses on the following APPRENTICE-level lab from the PortSwigger Web Security Academy:

1 OS command injection, simple case

This lab demonstrates how an attacker can exploit unsanitized user input that is directly passed to system commands, allowing them to execute arbitrary OS commands on the server.

---

LAB 1 - OS command injection, simple case

Lab Description :

Overview :

Solution :

We have check stock feature on the website.

Intercept the above request and do out of band interaction through collabarator

We can see that we get response from above collabarator to burp

If we try with productId we will get errror

Now we will try to exceute command of whoami from storeId and lab will be solved