Basic server-side template injection (code context) | 2023

Portswigger Lab Solution — SSTI Code Context | Karthikeyan Nagaraj

Check out the Basics of SSTI in my previous post

Lab Description:

Analysis:

For Example, I’m inserting{{5*5}} as Comment

2. Check outMy Account, we can see that there is a Functionality called thePreferred name which may be vulnerable

3. Intercept the traffic through burp and send it to Repeater — Ctrl+r

4. Let’s try to Inject Tornado’s Template Expressions.

The Below Syntax is used for Tornado

5. Let’s test whether the Expression is Executing or Not by Sending the below payload into the parameterblog-post-author-display

Reload the Page. Make sure to turn Off the proxy or the Intercept Off

It’s Working : )

Some of the Payloads

{{7*7}} = 49
${7*7} = ${7*7}
{{foobar}} = Error
{{7*’7'}} = 7777777

6. As we know the syntax of Tornado’s Template and we also know that the expressions are Executing, So Let’s use the python code as a payload to deletemorale.txt

Feel Free to Ask Queries via LinkedIn and to Buy me a Cofee : )

Thank you for Reading!!

Happy Hunting ~

portswigger , ssti , bug bounty , tornado , injection , karthikeyan nagaraj ,cyber w1ng , python