In this post, we’re going to solve the PortSwigger lab: “Blind OS command injection with time delays”.
To solve the lab, we need to cause a 10-second response time delay on the server. To do this, we’ll use the OS Command Injection found in the feedback function.
So we head to the “Submit feedback” button:
As we can see, there are several fields to fill out. So let’s fill them in:
Now, before submitting the feedback, we prepare Burp Suite to receive the requests:
With this ready, we submit the feedback to capture the request:
This is the request that’s sent to the server when submitting feedback. To handle it, we send it to the repeater by pressing Ctrl R:
Once in the repeater, we can observe how a valid request simply gets a 200 status response and not much else.
However, among all the parameters being sent, we’re going to try to see if we can execute a command in any of them:
$(sleep 10)
In the message field, we can escape a command to execute it and thus cause a 10-second response delay on the server, which was what the lab asked us to do.
In this way, we solve the lab:
