MM1H·Aug 22From Guest WiFi to Root: How One API Leak + SSTI Destroyed a Luxury ResortHow an exposed API endpoint, Jinja2 SSTI, and password exposure led to full root compromise on a Flask WiFi captive web application portal.5 min read·m1h.hashnode.dev1
Kkareem Mohamed·Aug 10Do Not Disturb: A walkthrough of THM Hacker Holidays - Day 7Step-by-step THM Hacker Holidays Day 7 walkthrough. Exploit NoSQLi, EJS SSTI, and Node.js inspector privilege escalation with 0xY0K4_CL4W.4 min read·kmb.hashnode.dev
YYogeshwar Peela·Aug 4TryHackMe : Do Not Disturb WriteupComplete Do Not Disturb THM walkthrough covering NoSQL injection, EJS SSTI, Node Inspector abuse, privilege escalation, and root.8 min read·exploitnotes.hashnode.dev1
FFalkenkralle·Aug 2Template TerrorHow I found and exploited server-side template injection in a Flask/Jinja2 CTF app — reading /etc/passwd and getting RCE, mistakes and all.9 min read·ttpsandtricks.hashnode.dev
YYogeshwar Peela·Jul 14HackTheBox : JinjaCareComplete Hack The Box JinjaCare writeup covering wkhtmltopdf HTML injection, local file inclusion, Flask SSTI, Jinja2 sandbox escape, and root RCE.9 min read·exploitnotes.hashnode.dev
NNeville Iregi·Apr 30Hack The Box: BikeServer-Side Template Injection (SSTI) in a Node.js application using the Handlebars template engine14 min read·m0ng00s3-blog.hashnode.dev
Mmaulik srivastava·Jan 22Deconstructing SSRF+SSTI vulns to gain RCE in a Message Broker environmentConquering TryHackMe's: Rabbit_store12 min read·pub.nexttechlabap.in
Mmaulik srivastava·Jan 21Conquering TryHackMe's:Rabbit_storeDescription: Rabbit Store is medium level machine from tryhackme to test your basic web testing skills and linux basics. it can be conquered if u have understanding of SSRF and SSTI vulnerabilities to achive RCEgain access to shell. Therefore, retrie...12 min read·mooli.hashnode.dev
YYoussef Ketaj·Sep 20, 2025Server-Side Template Injection (SSTI) : De la Détection à l'Exécution de CodeDécouvrez les dangers du SSTI et les techniques pour protéger vos serveurs contre des attaques critiques11 min read·starter-kit-xi-seven.vercel.app
IIdo Abramov·Jul 14, 2025HackTheBox - Server-side Attacks - Skills Assessment WalkthroughScenario You are tasked to perform a security assessment of a client's web application. Apply what you have learned in this module to obtain the flag. Walkthrough Accessing the target URL redirects us to the next page: After browsing the site for a ...3 min read·id0xa.hashnode.dev
