🧪 Labs › Injection

When user input becomes part of a server template, the template engine runs it.

What it is

Web apps render pages with template engines (Jinja2, Twig, Freemarker, and others). If user input is concatenated into the template SOURCE rather than passed in as data, the engine evaluates it — and template engines can usually reach the host language.

That turns a cosmetic feature (a greeting that echoes your name) into server-side code execution.

The tell is that the engine does maths or object access on your input: input that should print literally instead gets evaluated.

How to approach it

• Find a place where your input is reflected into a rendered page — a name, a subject line, an error message.
• Send a harmless expression the engine would evaluate but a literal string wouldn't, and see whether the result is computed.
• Identify which engine you're talking to from how different expressions behave — the escalation path differs per engine.
• From evaluation, work toward reading server data, then toward command execution through the objects the engine exposes.

How to prevent it

• Never let user input reach the template as template source — pass it as a context variable.
• Render untrusted values in a sandboxed/logic-less template where possible.
• Keep the engine patched and its sandbox enabled.

More Injection labs

• SQL Injection — Make the database answer a question the application never meant to ask.
• XML External Entities (XXE) — A permissive XML parser can be told to fetch files and URLs for you.
• OS Command Injection — A feature that shells out to a system command, with your input in the command line.
• Insecure Deserialization — Turning attacker-controlled bytes back into live objects can run attacker code.

← All labs