--- title: PicoCTF Web Exploitation Easy Category Web Challenge... description: A walkthrough of a PicoCTF web exploitation challenge focused on Server Side Template Injection (SSTI). Covers how to identify the Jinja2 template engine by... canonical: https://daily.dev/posts/picoctf-web-exploitation-easy-category-web-challenge-sstl-1--0jlqq9qrb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PicoCTF Web Exploitation Easy Category Web Challenge [SSTL 1] | daily.dev og:description: A walkthrough of a PicoCTF web exploitation challenge focused on Server Side Template Injection (SSTI). Covers how to identify the Jinja2 template engine by... og:url: https://daily.dev/posts/picoctf-web-exploitation-easy-category-web-challenge-sstl-1--0jlqq9qrb og:image: https://api.daily.dev/og/posts/0Jlqq9qrB.png og:image:alt: PicoCTF Web Exploitation Easy Category Web Challenge [SSTL 1] og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PicoCTF Web Exploitation Easy Category Web Challenge [SSTL 1] **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 5 min read · 0 upvotes · 0 comments ## Summary A walkthrough of a PicoCTF web exploitation challenge focused on Server Side Template Injection (SSTI). Covers how to identify the Jinja2 template engine by testing payloads like {{ 8*8 }}, then explains key Python/Flask objects (config, request, self) and their internal chains (__init__, __globals__, __builtins__) used to reach the os module and execute system commands. Four working payloads are demonstrated to retrieve the flag, with emphasis on understanding the object traversal path rather than blindly copying payloads. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I detect which template engine is vulnerable to server side template injection on a web page? Test different template syntax payloads and observe which one evaluates. Injecting {{ 8*8 }} and getting 64 back indicates a double-curly-brace engine like Jinja2, Twig, or Handlebars, while ${ 8*8 } evaluating instead points to a different family. Confirming further with {{ self }} or {{ config }} returning valid Flask-specific output narrows it down to Jinja2 specifically. _Anyone probing template engines for SSTI keeps payload notes and technique breakdowns organized on daily.dev._ ### What Jinja2 SSTI payload can achieve remote code execution to read files like a flag? Chaining through Python's internal object references reaches the os module for command execution. For example, {{ self.__init__.__globals__.__builtins__.__import__('os').popen('ls').read() }} traverses the self object's __init__ method to __globals__, grabs __builtins__, imports os, and runs a shell command; a similar chain via config.__class__.__init__.__globals__['os'] also works to read a flag file. _Developers testing template rendering for injection risks track exploitation techniques like this on daily.dev._ ## Similar posts on daily.dev - [My Instructor Said “You Can’t Get a Shell.” I Got Root. — Full Web Pentest Exam Write-Up](https://daily.dev/posts/my-instructor-said-you-can-t-get-a-shell-i-got-root-full-web-pentest-exam-write-up-vt3b7yegw) · InfoSec Write-ups · 4 upvotes · 1 comments - [HTB: HackNet](https://daily.dev/posts/htb-hacknet-ytv8gsdvp) · 0xdf hacks stuff · 0 upvotes · 0 comments - [CodePartTwo HTB Walkthrough](https://daily.dev/posts/codeparttwo-htb-walkthrough-gzwjbhyde) · InfoSec Write-ups · 1 upvotes · 0 comments - [Host & Network Penetration Testing: Exploitation CTF 2 — eJPT \(INE\)](https://daily.dev/posts/host-network-penetration-testing-exploitation-ctf-2-ejpt-ine--tlzhkrkra) · InfoSec Write-ups · 0 upvotes · 0 comments - [Host & Network Penetration Testing: Exploitation CTF 1 — eJPT \(INE\)](https://daily.dev/posts/host-network-penetration-testing-exploitation-ctf-1-ejpt-ine--gcomrsqby) · InfoSec Write-ups · 1 upvotes · 0 comments --- Tags: [#python](https://daily.dev/tags/python) [View this post on daily.dev](https://daily.dev/posts/picoctf-web-exploitation-easy-category-web-challenge-sstl-1--0jlqq9qrb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PicoCTF Web Exploitation Easy Category Web Challenge [SSTL 1]","url":"https://daily.dev/posts/picoctf-web-exploitation-easy-category-web-challenge-sstl-1--0jlqq9qrb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/picoctf-web-exploitation-easy-category-web-challenge-sstl-1--0jlqq9qrb"},"datePublished":"2026-07-06T07:28:43.833Z","dateModified":"2026-09-14T06:59:13.629Z","description":"A walkthrough of a PicoCTF web exploitation challenge focused on Server Side Template Injection (SSTI). Covers how to identify the Jinja2 template engine by...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/71284912c0348737cc0c2e682d975f01?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/71284912c0348737cc0c2e682d975f01?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoSec Write-ups","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoSec Write-ups","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/f0dc21b5bbfd46fda36f7b4b53dd1705","url":"https://daily.dev/sources/infosecwriteups"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/picoctf-web-exploitation-easy-category-web-challenge-sstl-1--0jlqq9qrb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"python","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoSec Write-ups","item":"https://daily.dev/sources/infosecwriteups"},{"@type":"ListItem","position":3,"name":"PicoCTF Web Exploitation Easy Category Web Challenge [SSTL 1]"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/picoctf-web-exploitation-easy-category-web-challenge-sstl-1--0jlqq9qrb#faq","mainEntity":[{"@type":"Question","name":"How do I detect which template engine is vulnerable to server side template injection on a web page?","acceptedAnswer":{"@type":"Answer","text":"Test different template syntax payloads and observe which one evaluates. Injecting {{ 8*8 }} and getting 64 back indicates a double-curly-brace engine like Jinja2, Twig, or Handlebars, while ${ 8*8 } evaluating instead points to a different family. Confirming further with {{ self }} or {{ config }} returning valid Flask-specific output narrows it down to Jinja2 specifically. Anyone probing template engines for SSTI keeps payload notes and technique breakdowns organized on daily.dev."}},{"@type":"Question","name":"What Jinja2 SSTI payload can achieve remote code execution to read files like a flag?","acceptedAnswer":{"@type":"Answer","text":"Chaining through Python's internal object references reaches the os module for command execution. For example, {{ self.__init__.__globals__.__builtins__.__import__('os').popen('ls').read() }} traverses the self object's __init__ method to __globals__, grabs __builtins__, imports os, and runs a shell command; a similar chain via config.__class__.__init__.__globals__['os'] also works to read a flag file. Developers testing template rendering for injection risks track exploitation techniques like this on daily.dev."}}]} ```