Merge pull request swisskyrepo#521 from mh4ckt3mh4ckt1c4s/ssti-detection

Add SSTI detection payload + related resource
pickkaa · Aug 9, 2022 · 683167d · 683167d
2 parents 11271d9 + 9d274a3
commit 683167d
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/Server Side Template Injection/README.md b/Server Side Template Injection/README.md
@@ -89,6 +89,13 @@ python2.7 ./tplmap.py -u "http://192.168.56.101:3000/ti?user=InjectHere*&comment
 ![SSTI cheatsheet workflow](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Images/serverside.png?raw=true)
 
 ---
+## Detection
+
+In most cases, this polyglot payload will trigger an error in presence of a SSTI vulnerability :
+
+```
+${{<%[%'"}}%\.
+```
 
 ## ASP.NET Razor
 
@@ -881,3 +888,4 @@ $str.valueOf($chr.toChars($out.read()))
 * [Handlebars template injection and RCE in a Shopify app ](https://mahmoudsec.blogspot.com/2019/04/handlebars-template-injection-and-rce.html)
 * [Lab: Server-side template injection in an unknown language with a documented exploit](https://portswigger.net/web-security/server-side-template-injection/exploiting/lab-server-side-template-injection-in-an-unknown-language-with-a-documented-exploit)
 * [Exploiting Less.js to Achieve RCE](https://www.softwaresecured.com/exploiting-less-js/)
+* [A Pentester's Guide to Server Side Template Injection (SSTI)](https://www.cobalt.io/blog/a-pentesters-guide-to-server-side-template-injection-ssti)