Blind OS command injection with out-of-band interaction – PortSwigger Write Up

In this post, we’re going to solve the PortSwigger lab: “Blind OS command injection with out-of-band interaction”.

To solve the lab, we need to trigger a DNS lookup to the Burp Suite public server (burpcollaborator.net). To do this, we’ll use a Blind OS Command Injection found in the feedback function.

As we can see, there are several fields to fill out. So let’s fill them in:

Now, before submitting the feedback, we prepare Burp Suite to receive the requests:

With this ready, we submit the feedback to capture the request:

This is the request that’s sent to the server when submitting feedback. To handle it, we send it to the repeater by pressing Ctrl R:

Once in the repeater, we can observe how a valid request simply gets a 200 status response and not much else.

However, among all the parameters being sent, we’re going to try to see if we can execute a command in any of them, and with that, perform a DNS lookup to the Burp Suite server:

When we make this request, if we refresh the page, we’ll realize that we’ve solved the challenge:

In this case, it’s true that the best way to tackle “out-of-band” style challenges is to have Burp Suite PRO to be able to use the Burp Collaborator client feature:

In fact, the next and final OS Command Injection challenge (at least as of February 2022) can’t be solved without Burp Suite PRO.