webPromedium
Lab 213 — PingCraft — SSTI via Template Preview Rendering
hackadvisor
Task: Express.js notification platform with template preview endpoint using JavaScript Function constructor for server-side template literal evaluation. Solution: SSTI via ${} expressions in POST /api/templates/preview, escalated to process.env disclosure via ${JSON.stringify(process.env)} to extract FLAG from environment variables.
$ ls tags/ techniques/
environment_variablessstinodejsjavascriptexpresstemplate_injectiondecoy_flagfunction_constructornotification_platformtemplate_literalsprocess_env
decoy_flag_recognitionprocess_env_disclosuressti_js_template_literals
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 237 — MailCraft — SSTI in Email Template Preview— hackadvisor
- [web][Pro]Lab 133 — MailForge — SSTI via Handlebars Template Preview— hackadvisor
- [web][Pro]Lab 236 — PulseAlert — Blind SSTI via Notification Template Engine— hackadvisor
- [web][Pro]Lab 247 — PulseGuard — SSTI in Webhook Notification Templates— hackadvisor
- [web][Pro]MailPilot — SSTI in Template Preview— hackadvisor