Hacking Websites: Server-Side Template Injection | picoCTF

💻 Learn Web App Pentesting for free, right in your browser 👉 https://www.hackstation.io/

⏱️ Only 3 hours
🛠️ No VMs, no setup
🔓 Learn by hacking, not watching
🆓 Completely free

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

This video covers a complete writeup of the PicoCTF 2025 SSTI1 challenge from the Web Exploitation category. I explain how the vulnerability works, demonstrate the use of template expressions like {{7*7}} to confirm Jinja2, and walk through exploiting Server Side Template Injection to read files and capture the flag. This step-by-step guide is useful for CTF players, beginners in web security, and anyone learning exploitation techniques.

Disclaimer: This video is for educational purposes only.