Blind Command Injection

Definitions

1. A command-injection vulnerability where attacker-supplied commands execute on the server, but the results are not returned directly in the application response. Attackers verify success indirectly through timing, outbound connections, or side effects.

   In plain English: A command injection flaw where the attacker cannot see direct output and must infer success indirectly.

   Example: "The bug was blind command injection, so the tester confirmed execution by forcing DNS callbacks to an external listener."

Related Terms

• WAF
• SSRF
• HTTPS
• Blind XSS
• Crash Exploitation
• Custom Shellcode
• Heap Exploitation
• Heap Spray
• HPKP
• Hypervisor Escape