SSTI easy

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: ssti_context_variable_access

Summary

A Server-Side Template Injection (SSTI) challenge in Twig template engine. User input is rendered through the template engine without filtering.

SSTI easy — Web Kids 2.0

Description

A Server-Side Template Injection (SSTI) challenge in Twig template engine. User input is rendered through the template engine without filtering.

URL: http://kslweb3.spb.ctf.su/2-5/

Analysis

The application uses Twig (PHP template engine) and passes user input directly to the template. Entering {{7*7}} returns 49, confirming the presence of SSTI.

Key observation: a password variable containing the flag is accessible in the template context.

Solution

1. Check for SSTI: enter {{7*7}} — get 49
2. Try to access context variables
3. Enter {{password}} — get the flag ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Payload

{{password}}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍