Portswigger on Yusuf AlMahmeed

Exploiting XXE to Perform SSRF

Fri, 09 Oct 2026 18:09:00 +0300


Platform	PortSwigger Web Security Academy
Topic	XML external entity (XXE) injection
Lab	Exploiting XXE to perform SSRF attacks
Difficulty	Apprentice
Goal	Read the server’s IAM credentials from cloud metadata
Tools	Burp Suite (Proxy + Repeater)

The idea

In the file-retrieval lab the external entity pointed at a local file with file://. Point it at an http:// URL instead and the XML parser becomes an HTTP client that fetches whatever URL we give it. That is SSRF (server-side request forgery): making the server send requests to targets we choose, from its own trusted position on the network.

Exploiting XXE to Retrieve Files

Fri, 09 Oct 2026 17:43:00 +0300


Platform	PortSwigger Web Security Academy
Topic	XML external entity (XXE) injection
Lab	Exploiting XXE using external entities to retrieve files
Difficulty	Apprentice
Goal	Read `/etc/passwd` from the server
Tools	Burp Suite (Proxy + Repeater)

What is XXE?

XML external entity (XXE) injection happens when an application parses XML we control, and the parser (the library that reads the XML and turns it into data the app can use) is allowed to process external entities. An entity in XML is a named placeholder, declared in a DTD (Document Type Definition) and referenced in the document; an external entity takes its value from a URI the parser fetches. If we can declare our own entity that points at a local file, the parser reads that file and we can often get the contents reflected back.

Server-Side Template Injection in a Sandboxed Environment

Mon, 05 Oct 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	SSTI in a sandboxed environment
Difficulty	Expert
Engine	FreeMarker (Java), sandboxed
Goal	Read `/home/carlos/my_password.txt` and submit it
Tools	Browser, the Java API docs, a bytes-to-ASCII converter

The idea

In the documentation lab we escaped FreeMarker with ?new to instantiate Execute and run commands. Here that door is shut: the engine is sandboxed, so ?new and the dangerous helper classes are blocked. No arbitrary code execution.

Server-Side Template Injection via User-Supplied Objects

Mon, 05 Oct 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	SSTI with information disclosure via user-supplied objects
Difficulty	Practitioner
Engine	Django (Python)
Goal	Leak the framework’s `SECRET_KEY`
Tools	Browser, the engine’s own documentation

The idea

Not every SSTI ends in remote code execution. Django’s template language is deliberately sandboxed, there’s no {{7*7}} arithmetic, no imports, no os.system. But a sandbox that blocks code doesn’t necessarily block data: if a sensitive object is reachable from the template context, you can still read it. This lab leaks Django’s SECRET_KEY by doing exactly that.

Server-Side Template Injection with a Custom Exploit

Mon, 05 Oct 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	SSTI with a custom exploit
Difficulty	Expert
Engine	Twig (PHP)
Goal	Delete `/home/carlos/.ssh/id_rsa`
Tools	Browser, Burp Repeater, a text editor

The idea

Not every SSTI ends in a copy-paste payload for a known engine. This one is a custom exploit: we fingerprint the engine from its errors, notice that a real application object (user) is exposed inside the template, read the application’s own source code to learn what methods that object offers, and then chain two of those methods into exactly the primitive we need. No public payload exists for this; we build it from the app’s own code.

Basic Server-Side Template Injection (Code Context)

Tue, 29 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	Basic server-side template injection (code context)
Difficulty	Practitioner
Engine	Tornado (Python)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Burp Suite (Proxy + Repeater)

Plaintext context vs code context

In the basic case , our input became the whole template, so we could inject template syntax directly. Here it’s different: our input is dropped into an existing template expression, something like {{ our_input }}. That’s a code context. To inject, we first have to break out of the current expression with }}, then add our own.

Server-Side Template Injection in an Unknown Language

Tue, 29 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	SSTI in an unknown language with a documented exploit
Difficulty	Practitioner
Engine	Handlebars (Node.js)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Burp Suite (Repeater + Decoder)

The idea

You won’t always recognize the template syntax in front of you. That’s fine: the job is to make the server throw an error, read the stack trace to learn the engine, and then find a documented exploit for that engine. No prior knowledge of the language is required.

Server-Side Template Injection Using Documentation

Tue, 29 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	Server-side template injection using documentation
Difficulty	Practitioner
Engine	FreeMarker (Java)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Browser, the engine’s own documentation

The idea

Sometimes you don’t need a memorised payload. Once you know which template engine is running, its official documentation will often hand you everything you need, including the features that turn template rendering into command execution. This lab is exactly that: identify the engine from an error message, then read the docs to build the exploit.

Basic Server-Side Template Injection

Mon, 28 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	Basic server-side template injection
Difficulty	Apprentice
Engine	ERB (Ruby)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Burp Suite (Proxy + Repeater)

What is server-side template injection?

Server-side template injection (SSTI) happens when user input is embedded into a server-side template and then evaluated as template code rather than plain data. Because templates can run expressions (and often reach the underlying language), a successful injection usually leads to information disclosure or full remote code execution.

Blind OS Command Injection with Output Redirection

Sun, 27 Sep 2026 14:30:00 +0300


Platform	PortSwigger Web Security Academy
Topic	OS command injection
Lab	Blind OS command injection with output redirection
Difficulty	Practitioner
Goal	Run `whoami` and read its output
Tools	Burp Suite (Proxy + Repeater)

The idea

This is another blind injection: the feedback function runs a shell command with our input but returns nothing useful. Last time we proved execution with a time delay . This time we actually want the output of whoami, so we redirect it into a file inside a directory the web server will happily serve back to us, then just request that file.

Blind OS Command Injection with Time Delays

Sun, 27 Sep 2026 14:00:00 +0300


Platform	PortSwigger Web Security Academy
Topic	OS command injection
Lab	Blind OS command injection with time delays
Difficulty	Practitioner
Goal	Cause a 10-second delay to prove command execution
Tools	Burp Suite (Proxy + Repeater)

In the simple case the command’s output came straight back in the response. Here it doesn’t: the application runs a shell command with your input but never returns the result. That means we can’t just read the output of whoami, so we need an inference technique to confirm the injection actually ran.

OS Command Injection: Simple Case

Sat, 26 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	OS command injection
Lab	OS command injection, simple case
Difficulty	Apprentice
Goal	Execute `whoami` to retrieve the current user
Tools	Burp Suite (Proxy + Repeater)

What is OS command injection?

OS command injection (also called shell injection) happens when a web application passes user-controlled input into a system shell command without sanitizing it. If an attacker can inject shell metacharacters, they can append their own commands and have the server execute them, often with the privileges of the web application.

Portswigger on Yusuf AlMahmeed

Exploiting XXE to Perform SSRF

The idea

Exploiting XXE to Retrieve Files

What is XXE?

Server-Side Template Injection in a Sandboxed Environment

The idea

Server-Side Template Injection via User-Supplied Objects

The idea

Server-Side Template Injection with a Custom Exploit

The idea

Basic Server-Side Template Injection (Code Context)

Plaintext context vs code context

Server-Side Template Injection in an Unknown Language

The idea

Server-Side Template Injection Using Documentation

The idea

Basic Server-Side Template Injection

What is server-side template injection?

Blind OS Command Injection with Output Redirection

The idea

Blind OS Command Injection with Time Delays

What makes this one “blind”?

OS Command Injection: Simple Case

What is OS command injection?