Blind OS command injection with time delays

Platform: PortSwigger | Category: Command_injection | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Command_injection

Summary

Walkthrough of the PortSwigger Web Security Academy lab Blind OS command injection with time delays (Command_injection). This lab demonstrates a command_injection vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Command_injection

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

This lab contains a blind OS command injection vulnerability in the feedback function.

The application executes a shell command containing the user-supplied details. The output from the command is not returned in the response.

To solve the lab, exploit the blind OS command injection vulnerability to cause a 10 second delay.

Solution -

The feedback form is as follows

Captured request ->

By adding the & sleep # (Note the space before & and after #) / & sleep 10 &(URL-encode before sending) , we can see that the email parameter is vulnerable to command injection vulnerability, since there was time delay of 10 seconds.

By '#' we comment out the rest of the query. Since it is a bash script that is running in the background REQUEST

RESPONSE

Key Takeaways / Lessons

• Understanding Command_injection detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Blind OS command injection with time delays