SSTI Complete Lab Breakdown: Server-side template injection with a custom exploit

[@aaryan1143]

The explanation was so precise, I never even thought about generating an error at the File Upload section, thank you soo much!

[@nishantdalvi9470]

Hey brother i just have a little doubt over here, Why didn't we simply tried copy pasting RCE payloads in the context to Twig from HackTricks in this lab as we did in all the previous labs ?

[@ishajoshi4599]

Amazing series!!! You must make more walkthroughs like this, you were concise and clear and it made all the difference!

[@7SeasSecurity]

Really appreciate that Isha! We really do plan to make more videos for more of the Web Security Academy labs. We felt it was important to break these concepts down in a digestible format, but also practical enough to take away a working methodology on discovering cool vulnerabilities. Appreciate your time and glad to hear you’re enjoying the content!

[@z1ro_zb]

great explanation!, you should make more portswigger videos🙌

[@TheWorstGamerToLive]

These videos are so helpful, I refer to them very often

[@7SeasSecurity]

That’s great to hear! I really appreciate you checking out the video!

[@jaywandery9269]

This was a beautiful lab

[@gopikanna_]

Thanks man for the amazing explanations...♥

[@ujsimrananees]

Brilliant work!

[@acronproject]

Very good. Thank you MR.

[@cair0_]

that was 🔥

[@7SeasSecurity]

Thanks so much. I hope the video was helpful!

[@mrvDn]

amazing video man..

[@7SeasSecurity]

I really appreciate that! I hope it was helpful. More to come soon. Thanks so much for checking out the video!

[@Aftab700]

great work

[@7SeasSecurity]

Thank you! Hope it was helpful. Appreciate you checking out the video!

[@nishantdalvi9470]

In the error message (which gets triggered when we try to upload non image file) we can see that "User->setAvatar" the class name 'User' itself is used in order to call the setAvatar method doesn't it makes the setAvatar a static method. If it is a static method how are we able to access it with the help of an object instance user.setAvatar?

[@cair0_]

I can't see the live 😥

[@7SeasSecurity]

Thanks for the heads up! I have the vod saved so I’ll have to upload that and fix the link. Appreciate you! I’ll let you know when I fix that.