Python Flask Jinja2 SSTI Payload Analysis

I'll walk through a common SSTI payload pulled from PayloadsAllTheThings and look at how it works, using the Flask request object to get a function, which gives access to the __globals__. From there it gets the __builtins__ dictionary and the __import__ function.

[00:00] Introduction
[00:55] Data overview
[01:33] Making dummy Flask app
[02:35] Flask request object
[03:38] request in Jinja context
[04:22] attr / getattr / dot
[05:30] Using function to get __globals__
[07:40] Getting __builtins__ from __globals__
[09:31] Using __import__ to get the os module
[10:31] Getting execution
[11:50] Conclusion

#ssti #ctf #python #jinja2

[Mykmy]

this was very helpful
I admire you for being able to explain such intrinsic concepts of the Python language so well.
I hope one day to reach your level.