Challenge Name: Newsletter

the administrator put the backup file in the same root folder as the application, help us download this backup by retrieving the backup file name.

we will add this test email to intercept the request using BurpSuite :

So, As We Know the semicolon (;) is used to separate commands in a shell

and our Task here in this challenge is : download this backup by retrieving the backup file name.

So We need a shell command to show and list the content of the directory, and in the lab description, it gave us a hint and it was that the administrator put the backup file in the same root folder as the application.

So We just need the ls shell command, The ls shell command is used in Unix-like operating systems to list the contents of a directory.

okay but wait.. wait !

We will Add ; after “email=test%40gmail.com” and the ls command but we need to ensure that the shell continues processing as if ls was intended to be the last command to execute successfully, because if you only used ; ls, the command might have been interpreted differently by the server or the application, possibly ignoring or mishandling it due to how command parsing is set up, So we need to add another symbol to our command and it will be the || operator to ensure that the shell continues processing As I Mentioned Before.

So the full line will be like : email=test%40gmail.com; ls ||

So Just take the backup file Name and Submit it and Congratulations, You Solved The Challenge :)