PortSwigger: OS Command Injection on Yusuf AlMahmeed

Blind OS Command Injection with Output Redirection

Sun, 27 Sep 2026 14:30:00 +0300


Platform	PortSwigger Web Security Academy
Topic	OS command injection
Lab	Blind OS command injection with output redirection
Difficulty	Practitioner
Goal	Run `whoami` and read its output
Tools	Burp Suite (Proxy + Repeater)

The idea

This is another blind injection: the feedback function runs a shell command with our input but returns nothing useful. Last time we proved execution with a time delay . This time we actually want the output of whoami, so we redirect it into a file inside a directory the web server will happily serve back to us, then just request that file.

Blind OS Command Injection with Time Delays

Sun, 27 Sep 2026 14:00:00 +0300


Platform	PortSwigger Web Security Academy
Topic	OS command injection
Lab	Blind OS command injection with time delays
Difficulty	Practitioner
Goal	Cause a 10-second delay to prove command execution
Tools	Burp Suite (Proxy + Repeater)

In the simple case the command’s output came straight back in the response. Here it doesn’t: the application runs a shell command with your input but never returns the result. That means we can’t just read the output of whoami, so we need an inference technique to confirm the injection actually ran.

OS Command Injection: Simple Case

Sat, 26 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	OS command injection
Lab	OS command injection, simple case
Difficulty	Apprentice
Goal	Execute `whoami` to retrieve the current user
Tools	Burp Suite (Proxy + Repeater)

What is OS command injection?