Hands-On Application Penetration Testing with Burp Suite

Detecting SSTI

SSTI vulnerabilities depend a lot on the engine used by the tested application. However, the main idea in template engines is that you pass a parameter, which is interpreted by the engine, and it creates the view. So, most engines are waiting for a text to parse it and display it. Take the following as an example:

any=Hello 
<b>Hello</b> 

In the preceding example, the application receives a string and the engine automatically adds HTML tags to display it. Also, these engines can interpret values passed as parameters, such as operators. For example:

any=Hello ${7*7} 
Hello 49 

In this case, the engine evaluates the * operator with the values passed. So, if you pass an unexpected string as a parameter, it could be reflected, or ...