When a command runs but its output never appears in the response, data is recovered through side channels. A time-based oracle makes execution conditional on a guess and measures a deliberate delay; an out-of-band channel makes the target reach a host you control (DNS or HTTP) and carries command output in the hostname or request path. These are the same inference techniques used in blind SQL injection, applied to shell output.
Pages#
- DNS out-of-band channel: Encoding command output into a DNS subdomain label so it leaves a blind OS command injection target via name resolution, captured by interactsh or a dnsbin s...
- Time-based blind extraction: Using sleep and ping delays as a boolean oracle in blind OS command injection to confirm execution and extract data character by character when no output and...
Tools#
- commix: automates time-based and out-of-band blind extraction.
- interactsh: self-hostable DNS and HTTP callback capture.
- Burp Collaborator: integrated out-of-band interaction catcher.