Testing for asynchronous OS command injection vulnerabilities with Burp Suite - Port Swigger
Summary: PortSwigger describes asynchronous OS command injection as a case where an application is vulnerable to command injection but executes the command asynchronously, so the application's response shows no noticeable impact. The suggested test uses Burp Collaborator to inject a command that triggers an out-of-band network interaction, with Burp monitoring the Collaborator server to confirm execution, including interactions that arrive after a delay.
What's compelling: A command that leaves no trace in the application's response will not surface in normal response-based testing, so the only signal is an out-of-band interaction that may arrive late - and the Collaborator tab must be checked again to catch it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026