Server-Side Template Injection - Request technique

Krematorij

Administrator
Staff member
ADMIN
BFD MEMBER
LEGEND
ULTIMATE
SUPREME
MEMBER
BFD Legacy
Joined
Oct 22, 2024
Messages
1,121
Reaction score
16,250
Website
bfdcrew.pro
Deposit
1,002$
Hello,
I have a question about SSTI

So this is the case

This is the syntax that works
{{=7*7}} -> executes 49
{{=id}} -> execute my id (like whoami)


So my questions are: {{=******}} are syntax for what kind of template? Freemaker? Dot.JS ?
and can someone provide me payloads with this syntax, maybe to escalate from SSTI to RCE? :>

Thank you!!!!!!!!!!!!!!!!!!!
 
Top Bottom