Forum Discussion

QuickSloth's avatar
QuickSloth
Icon for Bronze II rankBronze II
25 days ago

Stuck on “Server-Side Template Injection: Ep.2 – Identifying SSTI Vulnerabilities”

None of the three apps are “breaking” for me.  For example the input of {{ dump(_SERVER) }} should return server information in at least one example.  But nope. 
help & support
netcat's avatar
netcat
Icon for Silver II rankSilver II
22 days ago

I just took the sample payload from the briefing, and it works on the first app, causing an error.
I think there's only one app using twig, where the above string would trigger.
SSTI...not my favorite.

QuickSloth's avatar
QuickSloth
Icon for Bronze II rankBronze II
22 days ago

> I just took the sample payload from the briefing
Sorry, which payload is that?

  • netcat's avatar
    netcat
    Icon for Silver II rankSilver II
    21 days ago

    This one: {{$<%=(*`|.'#-%>;}}

    • QuickSloth's avatar
      QuickSloth
      Icon for Bronze II rankBronze II
      19 days ago

      All three apps just echo back that same input.  

      • netcat's avatar
        netcat
        Icon for Silver II rankSilver II
        19 days ago

        Just one more click.