Python Flask Jinja2 SSTI Payload Analysis
I'll walk through a common SSTI payload pulled from PayloadsAllTheThings and look at how it works, using the Flask request object to get a function, which gives access to the _globals__. From there it gets the __builtins_ dictionary and the _import_ function.
Payload: https://github.com/swisskyrepo/Payloa...
Flask Request object: https://flask.palletsprojects.com/en/...
Flask globals: https://flask.palletsprojects.com/en/...
Jinja2 attr: https://jinja.palletsprojects.com/en/...
Python Function attributes: https://docs.python.org/3/reference/d...
☕ Buy Me A Coffee: https://www.buymeacoffee.com/0xdf
[00:00] Introduction
[00:55] Data overview
[01:33] Making dummy Flask app
[02:35] Flask request object
[03:38] request in Jinja context
[04:22] attr / getattr / dot
[05:30] Using function to get _globals_
[07:40] Getting _builtins_ from _globals_
[09:31] Using _import_ to get the os module
[10:31] Getting execution
[11:50] Conclusion
#ssti #ctf #python #jinja2
On this page of the site you can watch the video online Python Flask Jinja2 SSTI Payload Analysis with a duration of hours minute second in good quality, which was uploaded by the user 0xdf 03 August 2024, share the link with friends and acquaintances, this video has already been watched 1,634 times on youtube and it was liked by 78 viewers. Enjoy your viewing!
