"https://portswigger.net/web-security/os-command-injection/lab-blind-output-redirection">this</a> PortSwigger lab we again find a vulnerable <code>email</code> parameter:</p>
<p><img src="Resources/Images/Command%20Injection/Output%20Redirect%20Command%20Injection.png" alt="" /></p>
<p>We are told that the <code>/var/www/images</code> directory is writable but we cannot directly read it, so we leverage an LFI in the request which returns the image of a product:</p>
<p><img src="Resources/Images/Command%20In