vulns.cofield index
Enter
Search
LanguageEN
EnglishCurrentEspañolSame sectionPortuguês (Brasil)Same sectionFrançaisSame sectionDeutschSame section日本語Same section简体中文Same section
Learning
Browse all pagesCurrent: Playbooks
Testing playbook · advanced

Blind Command Injection with OAST

Use a callback-only DNS or HTTP marker to distinguish command execution from reflection without extracting command output.

command-injectionblindoastdnsexecution
Stable IDplaybook:blind-command-oastSource record dateHuman reviewNot recordedProvenanceCurated workflow
Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.

Every step requires authorization. Review side effects before running commands against a live system.

Method contract

Define the boundary before the test.

Preconditions
Current scope, observed technology, reachable feature, controlled identities or data, and a recovery plan.
Expected evidence
One observable response, state, or callback that distinguishes the hypothesis from normal behavior.
Negative control
The same action with the security-sensitive variable removed, replaced, or bound to its rightful owner.
False-positive checks
Cache, retry, race, reflection, proxy rewriting, stale sessions, and unrelated asynchronous activity.
Chain gate
Record the proven primitive and the next missing prerequisite. Do not expand impact until scope and authorization still permit the next step.
01

Confirm the command-execution hypothesis

Require stack or behavior evidence for a shell, process launcher, system utility, image or media converter, archive helper, diagnostic feature, or build task. Do not send shell separators blindly across every parameter.

Burp Suite
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
02

Record paired baselines

Save the normal request and a request containing a unique inert alphanumeric token. Note response, timing, state changes, and background-job delay. Reflection of the token does not support command execution.

CMDI017BASELINE
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
03

Choose one syntax family

Select a separator and callback utility consistent with the observed operating system and sink. Use a callback hostname that encodes only the case and variant. Do not include command output, usernames, hostnames, file contents, environment values, or secrets in the DNS label or HTTP path.

; nslookup cmdi017-semicolon.UNIQUE.oast.example
interactsh
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
04

Separate DNS from HTTP evidence

A DNS interaction can support execution of the name-resolution utility, but not arbitrary output access. If HTTP utilities are reasonably expected and policy permits, use a separate callback-only hostname. Do not download or execute remote content.

interactsh-client -server YOUR_PRIVATE_INTERACTSH_SERVER -json -o cmdi-interactions.jsonl
interactsh
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
05

Run syntax and origin controls

Repeat with the separator encoded or removed, use a fresh token, check the unsubmitted token, and rule out link scanners or your own requests. For asynchronous jobs, correlate the exact queue trigger and delay.

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
06

Stop at the harmless primitive

Report reproducible callback-only command execution and its reachable privilege boundary. Do not read files, enumerate the environment, establish persistence, open a shell, or access unrelated services to increase impact.

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Field notes

Common guidance

  • Callback labels should contain test metadata, never command output.
  • A security appliance may resolve suspicious hostnames. Unique request correlation and delimiter controls are required.
  • Time-based and OAST evidence can disagree because jobs, retries, and egress policies are separate systems.
  • The safest sufficient proof is a fresh callback that disappears when the suspected command delimiter is removed.
Related tools

Mapped workflow tools

ToolBurp SuiteToolinteractsh
Sources

References

Version history: normalized permanent page created 2026-08-20.