PortSwigger: Server-Side Template Injection on Yusuf AlMahmeed

Server-Side Template Injection in a Sandboxed Environment

Mon, 05 Oct 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	SSTI in a sandboxed environment
Difficulty	Expert
Engine	FreeMarker (Java), sandboxed
Goal	Read `/home/carlos/my_password.txt` and submit it
Tools	Browser, the Java API docs, a bytes-to-ASCII converter

The idea

In the documentation lab we escaped FreeMarker with ?new to instantiate Execute and run commands. Here that door is shut: the engine is sandboxed, so ?new and the dangerous helper classes are blocked. No arbitrary code execution.

Server-Side Template Injection via User-Supplied Objects

Mon, 05 Oct 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	SSTI with information disclosure via user-supplied objects
Difficulty	Practitioner
Engine	Django (Python)
Goal	Leak the framework’s `SECRET_KEY`
Tools	Browser, the engine’s own documentation

The idea

Not every SSTI ends in remote code execution. Django’s template language is deliberately sandboxed, there’s no {{7*7}} arithmetic, no imports, no os.system. But a sandbox that blocks code doesn’t necessarily block data: if a sensitive object is reachable from the template context, you can still read it. This lab leaks Django’s SECRET_KEY by doing exactly that.

Server-Side Template Injection with a Custom Exploit

Mon, 05 Oct 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	SSTI with a custom exploit
Difficulty	Expert
Engine	Twig (PHP)
Goal	Delete `/home/carlos/.ssh/id_rsa`
Tools	Browser, Burp Repeater, a text editor

The idea

Not every SSTI ends in a copy-paste payload for a known engine. This one is a custom exploit: we fingerprint the engine from its errors, notice that a real application object (user) is exposed inside the template, read the application’s own source code to learn what methods that object offers, and then chain two of those methods into exactly the primitive we need. No public payload exists for this; we build it from the app’s own code.

Basic Server-Side Template Injection (Code Context)

Tue, 29 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	Basic server-side template injection (code context)
Difficulty	Practitioner
Engine	Tornado (Python)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Burp Suite (Proxy + Repeater)

Plaintext context vs code context

In the basic case , our input became the whole template, so we could inject template syntax directly. Here it’s different: our input is dropped into an existing template expression, something like {{ our_input }}. That’s a code context. To inject, we first have to break out of the current expression with }}, then add our own.

Server-Side Template Injection in an Unknown Language

Tue, 29 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	SSTI in an unknown language with a documented exploit
Difficulty	Practitioner
Engine	Handlebars (Node.js)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Burp Suite (Repeater + Decoder)

The idea

You won’t always recognize the template syntax in front of you. That’s fine: the job is to make the server throw an error, read the stack trace to learn the engine, and then find a documented exploit for that engine. No prior knowledge of the language is required.

Server-Side Template Injection Using Documentation

Tue, 29 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	Server-side template injection using documentation
Difficulty	Practitioner
Engine	FreeMarker (Java)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Browser, the engine’s own documentation

The idea

Sometimes you don’t need a memorised payload. Once you know which template engine is running, its official documentation will often hand you everything you need, including the features that turn template rendering into command execution. This lab is exactly that: identify the engine from an error message, then read the docs to build the exploit.

Basic Server-Side Template Injection

Mon, 28 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	Basic server-side template injection
Difficulty	Apprentice
Engine	ERB (Ruby)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Burp Suite (Proxy + Repeater)

What is server-side template injection?

Server-side template injection (SSTI) happens when user input is embedded into a server-side template and then evaluated as template code rather than plain data. Because templates can run expressions (and often reach the underlying language), a successful injection usually leads to information disclosure or full remote code execution.