# Blind OS command injection with time delays

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fmf1R4RZv0snRKPpsnp5I%2F1.png?alt=media&#x26;token=d8a3f7d9-8850-46bf-aa7b-78d16d118d95" alt=""><figcaption></figcaption></figure>

Let's submit the feedback for one of these products.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FxR3NXdvFStxIGedugz3O%2F3.png?alt=media&#x26;token=e430704c-77a2-4ca8-8fcd-da3f09047f2c" alt=""><figcaption></figcaption></figure>

We can now proxy the traffic through Burp Suite.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FGtjWo25egC7U7jhbsJ5Z%2F4.png?alt=media&#x26;token=97eb15be-4017-4a0c-9e37-d6c00491ebe3" alt=""><figcaption></figcaption></figure>

Let's forward this request to the `Repeater` so that we can modify it. Once in the `Repeater` we can set the `email` parameter to the following and send the request:

```
x%40gmail.com||ping+-c+10+127.0.0.1||
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FjAXyr8yUuC8gRz6c5y3h%2F5.png?alt=media&#x26;token=7fb530ef-1964-4acf-8ebf-ce9f0e921f29" alt=""><figcaption></figcaption></figure>

The response takes 10 seconds to return. We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F9hoPAJGncMb4pe2EwuwH%2F6.png?alt=media&#x26;token=d1856606-6f7a-4e95-96e9-4d9ea02d0b05" alt=""><figcaption></figcaption></figure>
