Step 1: Multi-syntax probing
Different template engines use different syntaxes; a single {{7*7}} is not enough:
| Probe payload | Returns 49 on success | Engine candidates |
|---|---|---|
{{7*7}} |
49 | Jinja2 / Twig / Django DTL |
${7*7} |
49 | Freemarker / Velocity / EL |
<%= 7*7 %> |
49 | ERB (Ruby) / EJS |
#{7*7} |
49 | Pug / Slim |
{7*7} |
49 | Smarty |
⚠️ {{7*7}} Returning as-is ≠ no SSTI; you still need to test other syntaxes!
Step 2: Precise engine identification
After confirming SSTI, distinguish the engine (exploitation methods differ completely):
{{7*'7'}}
├─ 返回 7777777 → Jinja2
├─ 返回 49 → Twig 或 Django DTL
│ ├─ {{_self.env}} 有输出 → Twig
│ └─ {{settings.DEBUG}} 有输出 → Django DTL
└─ 返回错误 → 未知，测试 ${} 语法
Step 3: Next step
After the engine is confirmed → read_skill(id="ssti-methodology") obtain the exploitation method for the corresponding engine
Key: Django DTL does not support RCE; prioritize trying {{flag}} to directly access context variables!