Lab: Blind OS command injection with time delays
Summary: PortSwigger's lab presents a blind OS command injection vulnerability in an application's feedback function, where the application executes a shell command containing user-supplied details but does not return the command's output in the response. The exercise asks the tester to modify the email parameter to exploit the flaw and cause a 10 second delay.
What you should know: The command's output never comes back in the response, so the only signal of a successful injection is a 10 second delay - a reminder that an application can be executing attacker-supplied shell commands while every response looks normal.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026