webProeasy
SendForge
hackadvisor
Task: Email marketing platform with FreeMarker template editor allowing server-side template preview, SSTI vulnerability. Solution: Injected FreeMarker Execute payload via template preview API to achieve RCE and read flag from environment variables.
$ ls tags/ techniques/
decoy_flag_recognitiontemplate_preview_abuseprocess_env_disclosurefreemarker_ssti_execute_builtin
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 133 — MailForge — SSTI via Handlebars Template Preview— hackadvisor
- [web][Pro]Lab 134 — DocForge — FreeMarker SSTI Sandbox Escape via ?api Built-in— hackadvisor
- [web][Pro]Lab 237 — MailCraft — SSTI in Email Template Preview— hackadvisor
- [web][Pro]MailPulse— hackadvisor
- [web][Pro]MailPilot — SSTI in Template Preview— hackadvisor