Question

During a web application assessment, you find a network diagnostic feature that pings a user-supplied hostname. When you submit '127.0.0.1; whoami' the page returns only the normal ping output with no visible command result, and time-based payloads like '127.0.0.1 && sleep 10' produce no observable delay. You suspect command injection but cannot see any output. Which technique is MOST likely to confirm the vulnerability?

Accepted Answer

Inject a payload that triggers an outbound DNS lookup to a Burp Collaborator/attacker-controlled domain and monitor for the interaction

Answer

Submit a UNION-based SQL injection payload to enumerate the backend database tables

Answer

Encode the semicolon as %3B and resubmit, expecting the command output to render in the response

Answer

Launch a stored XSS payload to capture the administrator's session cookie