Web Hacking
Premium
Server-Side Template Injection
When user input lands in the template source instead of the context dict, the rendering engine treats it as code. The universal mechanism, polyglot detection, engine fingerprinting, and the four canonical RCE chains: Python class-hierarchy walk (Jinja2), filter pipeline (Twig), ?new() instantiation (Freemarker), reflection (Velocity) — plus sandbox bypass, real incidents, and the per-engine fix.
Members Only Content
This article is exclusively available to premium members of LazyHackers. Login or subscribe to read.
