Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum will be discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Centre. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTRE DISCORD

Create new post

OS injection command

Daniel | Last updated: Oct 18, 2024 09:19PM UTC

Hello PortSwigger: I have a question regarding this lab: https://portswigger.net/web-security/os-command-injection/lab-blind-out-of-band I used Burp's scanner to check for insertion points, and the results indicate that the message section is also vulnerable to OS command injection, with a high degree of certainty. However, when I tried executing a simple( ; sleep 10 )command to verify the vulnerability, it didn't work, whereas the same command works in the email section. My question is, could the lab be intentionally designed so that the exploit only works in the email section? Thank you

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.