Forum Discussion
Solved
Stuck on “Server-Side Template Injection: Ep.2 – Identifying SSTI Vulnerabilities”
None of the three apps are “breaking” for me. For example the input of {{ dump(_SERVER) }} should return server information in at least one example. But nope.
I just took the sample payload from the briefing, and it works on the first app, causing an error.
I think there's only one app using twig, where the above string would trigger.
SSTI...not my favorite.
netcat
Advocate
AdvocateI just took the sample payload from the briefing, and it works on the first app, causing an error.
I think there's only one app using twig, where the above string would trigger.
SSTI...not my favorite.
> I just took the sample payload from the briefing
Sorry, which payload is that?
