From a3e3ca049ef1d2d867f2a0f5c5effa36d00a57a3 Mon Sep 17 00:00:00 2001
From: heqnx <root@heqnx.com>
Date: Sun, 3 Aug 2025 01:13:55 +0300
Subject: added first two nfos

ssti-discovery-in-python.nfo | 92 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 92 insertions(+)
create mode 100644 ssti-discovery-in-python.nfo

(limited to 'ssti-discovery-in-python.nfo')

diff --git a/ssti-discovery-in-python.nfo b/ssti-discovery-in-python.nfo
new file mode 100644
index 0000000..bbea9cc
--- /dev/null
+++ b/ssti-discovery-in-python.nfo
@@ -0,0 +1,92 @@
+.:: SSTI Discovery in Python ::.

+Server-Side Template Injection (SSTI) is a critical vulnerability in web
+applications that allows attackers to inject malicious template code,
+potentially leading to remote code execution (RCE). This research presents a
+Python-based tool designed to identify and analyze SSTI vulnerabilities in
+Jinja2 templates, a popular templating engine. By dynamically importing modules
+and enumerating their attributes, the tool discovers potential RCE vectors,
+enabling security researchers to assess and mitigate SSTI risks effectively.

+[ Introduction ]

+The tool leverages Python's importlib to dynamically import user-specified
+modules and a custom enumeration function to inspect their attributes, globals,
+and subclasses. By simulating Flask and Django contexts, it identifies paths to
+potentially dangerous objects like os.system or subprocess.Popen, which are
+common SSTI exploit primitives.

+Note that False Positives are common and most vectors should be tested manually.
+Currently, the tool works by potentially dangerous functions, modules and
+keywords.

+The tool code repository is located at https://cgit.heqnx.com/ssti-discovery and
+can be cloned easily with git clone https://cgit.heqnx.com/ssti-discovery.

+[ Tool Usage ]

+$ python3 ssti-discovery.py -h
+usage: ssti-discovery.py [-h] --module MODULE [--framework {jinja2,django}] [--output OUTPUT]

+SSTI RCE Vector Discovery Tool

+options:
+  -h, --help            show this help message and exit
+  --module MODULE       Module to import (e.g., os, numpy, myutils)
+  --framework {jinja2,django}
+                        Template framework to simulate (jinja2 or django)
+  --output OUTPUT       Output file for results (default: console)

+[ Tool Output Example ]

+$ python3 ssti-discovery.py --module numpy --framework jinja2

+  "module": "numpy",
+  "framework": "jinja2",
+  "rce_vectors": [

+      "path": "dict.__subclasses__.CallbackDict",
+      "type": "potentially dangerous class, investigate manually",
+      "details": "access to CallbackDict"

+      "path": "lipsum.__globals__.os",
+      "type": "potentially dangerous module, investigate manually",
+      "details": "access to 'os' module"

+      "path": "joiner.__call__",
+      "type": "potentially dangerous function, investigate manually",
+      "details": "access to '__call__' function"

+      "path": "joiner.__call__.__globals__.os",
+      "type": "potentially dangerous module, investigate manually",
+      "details": "access to 'os' module"

+      "path": "namespace.__getattribute__.__globals__.os",
+      "type": "potentially dangerous module, investigate manually",
+      "details": "access to 'os' module"

+      "path": "request._load_form_data",
+      "type": "potentially dangerous function, investigate manually",
+      "details": "access to '_load_form_data' function"

+[ Payload Testing ]

+The ssti-app.py is a Python-based tool built with Flask and Jinja2 to
+help in identifying and testing Server-Side Template Injection payloads.
+This tool provides a controlled environment to execute and analyze Jinja2
+template payloads, enabling users to explore potential remote code execution
+(RCE) vectors in web applications.

+The tool accepts command-line arguments to import Python modules (e.g., os,
+subprocess) into the Jinja2 environment, simulating real-world scenarios where
+sensitive modules might be exposed. The Flask webapp runs on localhost on port
+:5000. A basic index.html interface (served at /) allows for easy interaction,
+making it accessible for both manual and automated testing.

cgit v1.2.3