Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

'Lab: Blind OS command injection with time delays' provided solution doesn't work

Shwetank | Last updated: Aug 02, 2022 09:03AM UTC

Neither the provided solution of the lab 'Lab: Blind OS command injection with time delays' (https://portswigger.net/web-security/os-command-injection/lab-blind-time-delays) nor any community solutions are working. The lab wants attacker to submit a feedback form with OS command injection on 'email' field like this - email=x||ping+-c+10+127.0.0.1||. However, this always gives 400 BAD REQUEST in HTTP response with body as "Missing parameter". Help me understand if I am missing something here.

Ben, PortSwigger Agent | Last updated: Aug 02, 2022 09:15AM UTC

Hi Shwetank, I have just run through this lab using the written solution and have been able to solve the lab successfully so it does appear to be working as expected. Are you intercepting the feedback request within Burp and then altering the email parameter to include the OS command injection payload? What does the request you are sending look like?

Shwetank | Last updated: Aug 02, 2022 09:20AM UTC