The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable to run any bash with the http request? What am I doing wrong here?

<!DOCTYPE html>
<html lang="en">
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Level 5</title>
    <link href="http://netdna.bootstrapcdn.com/bootstrap/3.0.0/css/bootstrap.min.css" rel="stylesheet">
    <link href="http://netdna.bootstrapcdn.com/bootstrap/3.0.0/css/bootstrap-theme.min.css" rel="stylesheet">
    <link href="site.css" rel="stylesheet">
    <script src="sn.js"></script>

  <div class="container">
    <div class="page-header">
      <h1>Try This</h1>
      <p class="lead">
        <h2>Bash & Shell</h2>

    <form class="navbar-form navbar-left" role="editvar" id="envform">
          <div class="form-group">
            <input type="text" class="form-control" placeholder="value" name="filter" onkeydown="testForEnter();">
          <button type="button" class="btn btn-default" onclick="sendvalue(this.form.filter.value)">Submit</button>
    <div id="envlist">
      <pre>Waiting for variable...</pre>
<script language="JavaScript">
  function testForEnter() {
    if (event.keyCode == 13)
      event.cancelBubble = true;
      event.returnValue = false;

var http_request = false;

  function getenv(newvalue) {
    if (window.XMLHttpRequest) { // non IE
      http_request = new XMLHttpRequest();
    else if (window.ActiveXObject) { //
      try {
        http_request = new ActiveXObject("Microsoft.XMLHTTP");
      catch (error) {}
    if (!http_request) {
      alert('Cannot create XML HTTP instance');
      return false;

    http_request.onreadystatechange = stateManager;
    var myurl = "cgi-bin/env.php";

    myurl = myurl + "?filter=" +  sanitize(newvalue);

    http_request.open("GET", myurl, true);

  function stateManager() {
    if (http_request.readyState == 4) {
      if (http_request.status == 200) {
      } else {
        alert('There was a problem with the request.');

  function updatepage(str) {
    document.getElementById("envlist").innerHTML = str;

  function sendvalue(newvalue) {


Server Ip:

Link to the index page:

php page:

known parameter: ?fitler=

Attempt 1 (burp suite repeater):


Attempt 2 (burp suite repeater):

POST<?php echo shell_exec(ls); ?>

Attempt 3 (burp suite repeater):

Http Header:

Http Content:
<?php system(ls); ?>

Attempt 4 (burp suite repeater):

Http Header:

Http Content:
<?php system(ls); ?>
  • Please post your attempts. Also, please don't include screenshots of text - paste the text instead.
    – user163495
    Mar 3, 2022 at 0:47
  • @MechMK1 Thanks for your suggestion, I have made changes accordingly
    – UkaChan
    Mar 3, 2022 at 1:30
  • The code is referencing cgi-bin/env.php not test.php, perhaps you need to send the payload to env.php instead?
    – wireghoul
    Mar 4, 2022 at 0:03


You must log in to answer this question.

Browse other questions tagged .