> For the complete documentation index, see [llms.txt](https://kunalwalavalkar.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kunalwalavalkar.gitbook.io/write-ups/portswigger-labs/server-side-topics/command-injection/os-command-injection-simple-case.md).

# OS command injection, simple case

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Ft4vh5pVBSWi1NEnDP8cV%2F1.png?alt=media&amp;token=8a67ad09-9ae4-4fde-9061-c564d2c0752d" alt=""><figcaption></figcaption></figure>

Let's check the first product's stock.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fot0oS24I8OagJ1mPtJ8u%2F2.png?alt=media&amp;token=deffbff0-e7ec-40f3-af21-7aaced59b922" alt=""><figcaption></figcaption></figure>

We can intercept this request using the Burp Suite `Proxy` and forward it to the `Repeater` to modify it.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F8lEqn77ud4GZ2it0KbEq%2F3.png?alt=media&amp;token=3fa6a9a9-2abb-4e1a-b0aa-a12ccdac3b60" alt=""><figcaption></figcaption></figure>

Now let's set the `storeID` parameter to the following and send the request:

```
1|whoami
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FNEjIurHwGTk3pTDXzaWx%2F4.png?alt=media&amp;token=4000da31-5048-481a-bf99-6d2851ff4dee" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FGwLAJX0cE26o2SVQg8WB%2F5.png?alt=media&amp;token=54588820-a70c-4f80-bb62-f5bc4e81a423" alt=""><figcaption></figcaption></figure>
