Apprentice
← all rooms
SSTI Expert

Server-Side Template Injection

Jinja evaluates your input. Math first, then go deeper.

Mission briefing

TemplateCraft lets marketers preview personalised email copy in real time. Names and snippets are merged into server-side templates before display. Check whether template syntax in user input is evaluated on the server.

0 / 2 tasks 0 / 30 pts

Objectives

  • Confirm SSTI with {{7*7}}
  • Trigger the simulated escape flag
Task 1 Basic SSTI Medium 10 pts

Scenario

TemplateCraft merges your name into a Jinja preview template. Double-curly expressions might be evaluated before the page renders. Prove server-side evaluation by making the template compute a math expression.

Your approach

  1. Enter a normal name and view the preview output.
  2. Submit a template expression that multiplies two numbers.
  3. Confirm the rendered page shows the computed result, not literal braces.
  4. Copy the basic SSTI confirmation flag.
  5. Submit that flag.

Render {{7*7}}.

Open lab →
Hint

name={{7*7}}

Task 2 Gadget escape Expert 20 pts

Scenario

The preview engine exposes Python object internals through the template context. Deeper expressions can reach dangerous attributes on built-in types. Trigger the lab's simulated sandbox escape indicator.

Your approach

  1. Start from a working math expression payload.
  2. Traverse object class or MRO attributes allowed by Jinja.
  3. Build a chain that reaches a simulated command or flag helper.
  4. Read the escape flag from the rendered output.
  5. Submit the simulated escape flag.

Use a Jinja object-traversal style payload.

Open lab →
Hint

Chain {{7*7}} with __class__.__mro__ / __subclasses__ style traversal