Server Side Template Injection (SSTI)

Python

Jinja2

• Jinja2 SSTI - HackTricks
• Optimizing Server Side Template Injections payloads for jinja2
• Python vulnerabilities : Code execution in jinja templates
• Jinja2 template injection filter bypasses | 0day.work

Mako

• Python context free payloads in Mako templates · Podalirius

Tools

• Template Injection Table

Challenges

• Java - Server-side Template Injection
• Python - Server-side Template Injection Introduction
• Python - Blind SSTI Filters Bypass
• Python - SSTI contournement de filtres en aveugle

Resources

• PayloadsAllTheThings - Server Side Template Injection
• WSTG - v4.1 | OWASP Foundation