← back to room
SSTI
TemplateCraft — Preview
Scenario
The preview engine exposes Python object internals through the template context. Deeper expressions can reach dangerous attributes on built-in types. Trigger the lab's simulated sandbox escape indicator.
Your approach
- Start from a working math expression payload.
- Traverse object class or MRO attributes allowed by Jinja.
- Build a chain that reaches a simulated command or flag helper.
- Read the escape flag from the rendered output.
- Submit the simulated escape flag.
TemplateCraft
Email preview