Bug Bounty Hunting Essentials

Detection

SSTIs can appear in two different contexts:

• Plaintext context: It means that you can directly input HTML into the application, for example, in a text editor. Some examples of them are as follows:

smarty=Hello {user.name}
Hello user1 
    
freemarker=Hello ${username}
Hello newuser 
    
any=<b>Hello</b>
<b>Hello<b>

• Code context: This means that you enter values that are processed by the application and return a result. Some examples of them are as follows:

personal_greeting=username
Hello user01
    
personal_greeting=username<tag>
Hello 
    
personal_greeting=username}}<tag>
Hello user01 <tag>

Usually these kind result in XSS attacks, due to the evaluated input, so, if you enter an alert() function, it will be shown.

Once you detect that there's ...