Labs Covered

This write-up focuses on the following PRACTITIONER-level labs from the PortSwigger Web Security Academy:

2 Blind OS command injection with time delays

This lab demonstrates how an attacker can use time-based techniques to detect the success of command injection when no output is returned to the browser.

3 Blind OS command injection with output redirection

This lab shows how attackers can redirect command output to a location they can retrieve later, enabling them to exfiltrate data even if no output is returned in the HTTP response.

4 Blind OS command injection with out-of-band interaction

This lab demonstrates how attackers can use out-of-band channels, such as DNS queries, to receive feedback about whether command injection was successful.

5 Blind OS command injection with out-of-band data exfiltration

This lab builds on out-of-band interaction by showing how attackers can exfiltrate actual data through external DNS queries or other protocols.

Lab Description :

Solution :

There is a function to submit feedback:

Identify if one of the following parameters are vulnerable to non-Blind Command Injection: Parameters: name, email, subject, and message

|whoami
&whoami

-> payloads don’t work in this case.

Now, try to test the said parameters in Blind OS Command Injection


||ping -c 10 127.0.0.1||

The vulnerability affects the fields “Name”, “Email” and “Message”:

"; ping -c 127.0.0.1; echo "a

By adding the ` & sleep # ` (Note the space before & and after #) / ` & sleep 10 & (URL-encode before sending) , we can see that the email` parameter is vulnerable to command injection vulnerability, since there was time delay of 10 seconds.

By ‘#’ we comment out the rest of the query. Since it is a bash script that is running in the background

REQUEST

RESPONSE

Lab Description :

Solution :

There is a functionality for submitting feedback:

And the images are retrieved with a GET request.

We need to execute:

whoami > /var/www/images/whoami.txt

I sent the POST request to intruder and set 3 fields to attack in Sniper mode:

Then I added 3 payloads:

When we add payloads to the field subject the website returns an error:

To test output redirection in the email parameter missed during the intruder attack, we inject a command like whoami > /var/www/images/whoami via the URL parameter. A 200 OK response when we send request confirms the file was created .