Rce on Yusuf AlMahmeed

Basic Server-Side Template Injection (Code Context)

Tue, 29 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	Basic server-side template injection (code context)
Difficulty	Practitioner
Engine	Tornado (Python)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Burp Suite (Proxy + Repeater)

Plaintext context vs code context

In the basic case , our input became the whole template, so we could inject template syntax directly. Here it’s different: our input is dropped into an existing template expression, something like {{ our_input }}. That’s a code context. To inject, we first have to break out of the current expression with }}, then add our own.

Server-Side Template Injection in an Unknown Language

Tue, 29 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	SSTI in an unknown language with a documented exploit
Difficulty	Practitioner
Engine	Handlebars (Node.js)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Burp Suite (Repeater + Decoder)

The idea

You won’t always recognize the template syntax in front of you. That’s fine: the job is to make the server throw an error, read the stack trace to learn the engine, and then find a documented exploit for that engine. No prior knowledge of the language is required.

Server-Side Template Injection Using Documentation

Tue, 29 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	Server-side template injection using documentation
Difficulty	Practitioner
Engine	FreeMarker (Java)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Browser, the engine’s own documentation

The idea

Sometimes you don’t need a memorised payload. Once you know which template engine is running, its official documentation will often hand you everything you need, including the features that turn template rendering into command execution. This lab is exactly that: identify the engine from an error message, then read the docs to build the exploit.

Basic Server-Side Template Injection

Mon, 28 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	Server-side template injection
Lab	Basic server-side template injection
Difficulty	Apprentice
Engine	ERB (Ruby)
Goal	Delete `morale.txt` from Carlos’s home directory
Tools	Burp Suite (Proxy + Repeater)

What is server-side template injection?

Server-side template injection (SSTI) happens when user input is embedded into a server-side template and then evaluated as template code rather than plain data. Because templates can run expressions (and often reach the underlying language), a successful injection usually leads to information disclosure or full remote code execution.

Blind OS Command Injection with Output Redirection

Sun, 27 Sep 2026 14:30:00 +0300


Platform	PortSwigger Web Security Academy
Topic	OS command injection
Lab	Blind OS command injection with output redirection
Difficulty	Practitioner
Goal	Run `whoami` and read its output
Tools	Burp Suite (Proxy + Repeater)

The idea

This is another blind injection: the feedback function runs a shell command with our input but returns nothing useful. Last time we proved execution with a time delay . This time we actually want the output of whoami, so we redirect it into a file inside a directory the web server will happily serve back to us, then just request that file.

Blind OS Command Injection with Time Delays

Sun, 27 Sep 2026 14:00:00 +0300


Platform	PortSwigger Web Security Academy
Topic	OS command injection
Lab	Blind OS command injection with time delays
Difficulty	Practitioner
Goal	Cause a 10-second delay to prove command execution
Tools	Burp Suite (Proxy + Repeater)

In the simple case the command’s output came straight back in the response. Here it doesn’t: the application runs a shell command with your input but never returns the result. That means we can’t just read the output of whoami, so we need an inference technique to confirm the injection actually ran.

OS Command Injection: Simple Case

Sat, 26 Sep 2026 00:00:00 +0000


Platform	PortSwigger Web Security Academy
Topic	OS command injection
Lab	OS command injection, simple case
Difficulty	Apprentice
Goal	Execute `whoami` to retrieve the current user
Tools	Burp Suite (Proxy + Repeater)

What is OS command injection?

OS command injection (also called shell injection) happens when a web application passes user-controlled input into a system shell command without sanitizing it. If an attacker can inject shell metacharacters, they can append their own commands and have the server execute them, often with the privileges of the web application.

Rce on Yusuf AlMahmeed

Basic Server-Side Template Injection (Code Context)

Plaintext context vs code context

Server-Side Template Injection in an Unknown Language

The idea

Server-Side Template Injection Using Documentation

The idea

Basic Server-Side Template Injection

What is server-side template injection?

Blind OS Command Injection with Output Redirection

The idea

Blind OS Command Injection with Time Delays

What makes this one “blind”?

OS Command Injection: Simple Case

What is OS command injection?