Lab: Blind OS command injection with output redirection
Summary: This PortSwigger lab presents a blind OS command injection vulnerability in an application's feedback function, where the application executes a shell command containing user-supplied details but does not return the command output in the response. The lab shows that output redirection can capture that output into a writable folder the application uses to serve product catalog images, which can then be retrieved through the image loading URL.
Why it matters: The injected command still runs even though nothing comes back in the response, so a writable, web-served folder turns a blind injection into readable output - here, the result of the whoami command.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026