lab blind os command injection with output redirection | Portswigger lab solutions
Exploiting blind OS command injection by redirecting output,
In this video, CyberWorldSec shows you how to check for directory traversal
🆘🆘NEED HELP?? Join the Discord Server: / discord
FOLLOW ME EVERYWHERE
---------------------------------------------------
Instagram : / bug_bunty
Telegram group : https://t.me/ethical_hacker_learn
Discord: / discord
-------------------------------------------------
Disclaimer :
These materials are for educational and research purposes only.
These videos teach you cyber secuirty and all the practicals are conducted on a safe to test learning labs provided by PortSwigger's Web Security Academy.
PortSwigger's Web Security Academy enables the world to secure the web. Featuring over 190 topics and interactive labs. To know more go to https://portswigger.net/about
---------------------------------------------
SUBSCRIBE for more videos!
Thanks for watching!
Cheers!
----------------------------------------------
Lab: Blind OS command injection with output redirection
PRACTITIONER
LAB
Solved
This lab contains a blind OS command injection vulnerability in the feedback function.
The application executes a shell command containing the user-supplied details. The output from the command is not returned in the response. However, you can use output redirection to capture the output from the command. There is a writable folder at:
/var/www/images/
The application serves the images for the product catalog from this location. You can redirect the output from the injected command to a file in this folder, and then use the image loading URL to retrieve the contents of the file.
To solve the lab, execute the whoami command and retrieve the output.
You can redirect the output from the injected command into a file within the web root that you can then retrieve using your browser. For example, if the application serves static resources from the filesystem location /var/www/static, then you can submit the following input:
& whoami /var/www/static/whoami.txt &
The character sends the output from the whoami command to the specified file. You can then use your browser to fetch https://vulnerable-website.com/whoami... to retrieve the file, and view the output from the injected command.
#burpsuite
blind os command injection,
lab blind os command injection with output redirection