---
title: "Discussion on \"Template Terror\" | Hashnode"
description: "Discussion on \"Template Terror\". How I found and exploited server-side template injection in a Flask/Jinja2 CTF app — reading /etc/passwd and getting RCE, mistakes and all."
url: "https://hashnode.com/posts/template-terror/6a6f4e46e1f2446c9bfb5dc5"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Template Terror](https://ttpsandtricks.hashnode.dev/template-terror?utm_source=hashnode&utm_medium=feed)

How I found and exploited server-side template injection in a Flask/Jinja2 CTF app — reading /etc/passwd and getting RCE, mistakes and all.

Aug 2 · 9 min read · ttpsandtricks.hashnode.dev  
Read the article

-   [#ssti](https://hashnode.com/tag/ssti)
-   [#webhacking](https://hashnode.com/tag/webhacking)
-   [#ctf](https://hashnode.com/tag/ctf)
-   [#jinja2](https://hashnode.com/tag/jinja2)
-   [#flask](https://hashnode.com/tag/flask)

## Written by

[Falkenkralle](https://hashnode.com/@falkenkralle)

@falkenkralle

  
[View profile](https://hashnode.com/@falkenkralle)

A CS Student aspiring to become a Red Teamer.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.