https://th3b0ywh0l1v3d.github.io/tags/ssti/ Recent content in Ssti on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/borogpt/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/borogpt/ Source-map leak reveals JWT secret, forge admin token, then exploit Jinja2 SSTI for RCE. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/chakravyuh-defense/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/chakravyuh-defense/ A defensive web CTF where you patch the vulnerable source and the grader attacks your build: Secure the Login is fixed with parameterized queries, and Render & Plunder is sealed by binding SSTI input as render context plus adding an object-level authorization check to kill the IDOR. https://th3b0ywh0l1v3d.github.io/ctf/zer0d4yh31st/web/la-casa-de-papel/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/zer0d4yh31st/web/la-casa-de-papel/ A Flask/Jinja2 app renders user-supplied names directly into a template, enabling SSTI that dumps os.environ to leak the flag stored as an environment variable.