Lab: Blind OS command injection with out-of-band interaction
Summary: PortSwigger's lab presents a blind OS command injection flaw in an application's feedback function, where user-supplied details are passed into a shell command that runs asynchronously and does not affect the application's response. Because output cannot be redirected to an accessible location, the lab is solved by modifying the email parameter to trigger a DNS lookup to Burp Collaborator's default public server, since the Academy firewall blocks interactions with arbitrary external systems.
Key Takeaway: The injected command runs with no visible effect on the response, so a vulnerability that leaves no trace in application output can only be confirmed through an out-of-band channel like Burp Collaborator - the same blind spot an attacker would use to operate undetected.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026