Server-Side Template Injection

Question 1:
The initial URL you're testing looks like this: craw.in/render?name=test. You suspect SSTI. What is the first, simplest payload you should try to confirm your suspicion?

Question 2:
After injecting {{7*7}}, the page renders "49". This confirms SSTI. Which type of template engine is commonly associated with Python web frameworks like Flask and Django?

Question 3:
You need to identify what classes and methods are available. What Python built-in function is useful for inspecting objects and their attributes?

Question 4:
To achieve code execution, you often need to access the object class. What is the base class from which all classes inherit in Python?

Question 5:
What is a common attribute within the object class used to access subclasses?

Question 6:
You need to filter through a list of subclasses. What python special method is used to invoke commands?

Question 7:
After finding a suitable subclass, you might need to access its __init__ method. Which attribute allows you to access the __init__ method of a class?

Question 8:
Inside __init__, you often find __globals__. This gives access to the global namespace. What type of values does the global namespace provide?

Question 9:
Within the global namespace, you are likely to find a module that allows you to execute operating system commands. What common module is used for this purpose in Python?

Question 10:
Within the os module, what function is commonly used to execute shell commands?

Question 11:
You want to execute the command whoami. Complete the payload using the functions identified so far to execute "whoami".

Question 12:
To avoid issues with character encoding, which Python module can assist with encoding and decoding strings?