[Portswigger Academy] OS command injection
Portswigger Academy針對SQL Injection的Lab共有5題,內容還可以
1. Lab: OS command injection, simple case
This lab contains an OS command injection vulnerability in the product stock checker.
The application executes a shell command containing user-supplied product and store IDs, and returns the raw output from the command in its response.
To solve the lab, execute the whoami
command to determine the name of the current user.
第一題先試水溫,這題的題目說明 product stock checker的那個變數有command injection可以打,所以直接來
productId=4&storeId=2|whoami
2. Lab: Blind OS command injection with time delays
This lab contains a blind OS command injection vulnerability in the feedback function.
The application executes a shell command containing the user-supplied details. The output from the command is not returned in the response.
To solve the lab, exploit the blind OS command injection vulnerability to cause a 10 second delay.
這題不會有respond,需要讓網站卡10秒鐘以上
email=block2%40123.com||ping+-c+10+127.0.0.1||
3. Lab: Blind OS command injection with output redirection
This lab contains a blind OS command injection vulnerability in the feedback function.
The application executes a shell command containing the user-supplied details. The output from the command is not returned in the response. However, you can use output redirection to capture the output from the command. There is a writable folder at:
/var/www/images/
The application serves the images for the product catalog from this location. You can redirect the output from the injected command to a file in this folder, and then use the image loading URL to retrieve the contents of the file.
To solve the lab, execute the whoami
command and retrieve the output.
這題是建立在第三題的基礎上,現在希望可以在/var/www/images/
裡面寫入一個裝有whoami輸出的txt檔案。
&email=b2%40123.com||whoami+>+/var/www/images/whoami.txt||
4. Lab: Blind OS command injection with out-of-band interaction
需要用到Burp Collaborator這個付費功能,所以無法操作
5. Lab: Blind OS command injection with out-of-band data exfiltration
需要用到Burp Collaborator這個付費功能,所以無法操作