1. Web Security Academy
  2. Server-side template injection
  3. Exploiting
  4. Lab

Lab: Server-side template injection with information disclosure via user-supplied objects


This lab is vulnerable to server-side template injection due to the way an object is being passed into the template. This vulnerability can be exploited to access sensitive data.

To solve the lab, steal and submit the framework's secret key.

You can access your own account with the following credentials:

  • username = content-manager
  • password = C0nt3ntM4n4g3r