Uploaded July 2023 | Updated September 2026, 7 hours ago

---

In this video, Tib3rius completes three OS Command Injection labs from Portswigger Web Academy.

The labs completed are as follows:

OS command injection, simple case: portswigger.net/web-security/os-command-injection/lab-simple
Blind OS command injection with time delays: portswigger.net/web-security/os-command-injection/lab-blind-time-delays
Blind OS command injection with output redirection: portswigger.net/web-security/os-command-injection/lab-blind-output-redirection

0:00 - Introduction
0:20 - Starting Lab: OS command injection, simple case
1:44 - Fuzzing the productId field with Burp Intruder.
4:25 - Finding a fuzzing payload which appeared to work!
6:41 - Explaining why the storeId appears after our injected payload.
10:21 - Finding a secondary command injection point in the storeId.
11:31 - Demonstrating alternative payloads which achieve the same result.
14:03 - Starting Lab: Blind OS command injection with time delays
14:52 - Using Intruder to detect a potential command injection.
17:29 - Pointing out a subtle clue that command injection worked!
20:24 - Investigating why the payload caused a delay.
28:41 - Solving the lab using the sleep command.
29:13 - Starting Lab: Blind OS command injection with output redirection
30:09 - Identifying the command injection using Intruder again.
31:53 - Confirming the injection and solving the lab.
33:42 - Outro

Twitter: twitter.com/0xTib3rius
Twitch: twitch.tv/0xTib3rius
Courses: courses.tib3rius.com
Udemy: udemy.com/user/tib3rius
Discord: discord.com/invite/4qrvKMh
LinkedIn: linkedin.com/in/tib3rius
Facebook: facebook.com/0xTib3rius