Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Web-25. SSTI in the Greeting Card Generator
Mission
This greeting card generator is built with Flask/Jinja2 and renders the user's message directly through the template engine. Investigate how far template syntax execution can be pushed.
Hints
Hint 1 Show
This application uses the Jinja2 template engine
Hint 2 Show
Python expressions can be executed inside `{{ }}`
Hint 3 Show
Try using Python special attributes like __class__, __mro__, and __subclasses__