Hands-On Application Penetration Testing with Burp Suite

Using Burp Suite to exploit the vulnerability

Imagine you have a vulnerable application to SSTI that is using Twig. Twig (https://twig.symfony.com/) is a template engine developed in PHP.

We can detect the use of an engine because of the source code. Consider the following code snippet:

var greet = 'Hello $name'; 
<ul> 
<% for(var i=0; i<data.length; i++) 
{%> 
<li><%= data[i] %></li> 
<% } 
%> 
</ul> 
<div> 
<p> Welcome, {{ username }} </p> 
</div> 

Here, we can see that the application is waiting for data to present the final website to the user. When PHP reads the template, it executes all of the things that are contained there. For example, in 2015, James Kettle published a vulnerability that allows injecting a backdoor in Twig using the following ...