Lab: OS command injection, simple case

Lab Scenario: Our objective is to explore and exploit an OS command injection vulnerability in a web application's stock level check feature. By intercepting and modifying a request, we aim to execute arbitrary commands and observe the response, highlighting the risks associated with such vulnerabilities. Let's embark on this journey using Burp Suite:

1. Intercepting the Request:

   • Use Burp Suite to intercept and modify a request that checks the stock level.

   • Identify the parameter susceptible to OS command injection, in this case, the storeID parameter.

2. Modifying the Parameter:

   • Modify the storeID parameter by injecting the value 1|whoami. This payload is designed to execute the whoami command, revealing the name of the current user.

   • Observe that the modified request looks like this:

       storeID=1|whoami
     

3. Observing the Response:

   • Forward the modified request and observe the response from the server.

   • Note that the response contains the name of the current user, demonstrating the successful execution of the injected OS command.

Conclusion: This simple lab exercise provides hands-on experience in exploiting an OS command injection vulnerability. By following this step-by-step guide, users can gain insights into the potential risks associated with command injection and the importance of securing web applications against such exploits. Stay informed, keep learning, and continue exploring the dynamic field of cybersecurity to contribute to a more secure online environment.

Reference:

https://portswigger.net/web-security/os-command-injection/lab-simple