Hands-On Web Penetration Testing with Metasploit

Testing for OGNL out-of-band injection

Another way of confirming the vulnerability is by executing commands that will interact with our own server placed outside the organization. To check for OGNL Out-Of-Band (OOB) injection, we can execute a simple ping command, as in the following screenshot:

Before sending the payload to the server, we need to use tcpdump to listen on the public-facing interface of our server. We can execute the tcpdump icmp host <ip> command to filter the ICMP echo request and echo reply packets on our server. We need to do this so that when we execute the payload, we can get the ping echo request on our server, as