SSTI Complete Lab Breakdown: Basic server-side template injection (code context)
▹ Watch me Live on Twitch every Monday and Thursday! - / garr_7
Portswigger Web Security Academy Server-Side Template Injection (SSTI) Lab: Basic server-side template injection (code context) - https://portswigger.net/web-security/...
Additional References for Further Exploration:
My SSTI Explanation Vid - • SSTI Complete Lab Breakdown: Basic server-...
HackTricks SSTI Cheat Sheet - https://book.hacktricks.xyz/pentestin...
Awesome In-Depth SSTI Breakdown by PwnFunction - • Server-Side Template Injections Explained
------------------------------------------------------------------------------
In this series, we take a look at Web Security Academy's Server-Side Template Injection (SSTI) labs and break them down. The goal is to break down the concepts to not only get to the solution, but talk about methodology and the mental steps we take in order to discover these vulnerabilities in the wild.
Timestamps:
0:00 Intro
0:12 Lab Start: Mapping the Application
0:58 Using Hacktricks to Fuzz Comments (Failed)
1:48 Two Ways to Enumerate Templating Engine
2:32 Searching Hacktricks for Tornado Payloads
3:44 Fixing the Error In Our Payload
4:34 Final Payload
4:48 Recap & Takeaway
5:11 Outro
------------------------------------------------------------------------------
Music:
“Lovely City”
Produced by Calum Bowen
• Lovely City
“Snickers”
Produced by Epidemic Sound / Damma Beatz
• Damma Beatz - Snickers (Royalty Free Music)
“Ikebaby”
Produced by Robotprins
• Ikebaby (feat. @rymdkraft )
En esta página del sitio puede ver el video en línea SSTI Complete Lab Breakdown: Basic server-side template injection (code context) de Duración hora minuto segunda en buena calidad , que subió el usuario Seven Seas Security 18 abril 2022, comparta el enlace con amigos y conocidos, en youtube este video ya ha sido visto 15,391 veces y le gustó 183 a los espectadores. Disfruta viendo!
