SSTI easy

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: ssti_context_variable_access

Summary

Walkthrough of the CUSTOM Web SSTI easy. A Server-Side Template Injection (SSTI) challenge in Twig template engine. User input is rendered through the template engine without filtering.

Description

A Server-Side Template Injection (SSTI) challenge in Twig template engine. User input is rendered through the template engine without filtering.

URL: http://kslweb3.spb.ctf.su/2-5/

Analysis

The application uses Twig (PHP template engine) and passes user input directly to the template. Entering {{7*7}} returns 49, confirming the presence of SSTI.

Key observation: a password variable containing the flag is accessible in the template context.

Solution

1. Check for SSTI: enter {{7*7}} — get 49
2. Try to access context variables
3. Enter {{password}} — get the flag ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Payload

{{password}}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering ssti_context_variable_access was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • SSTI easy • Difficulty: Easy