This repository provides an example PHP application using Twig templates to illustrate Server-Side Template Injection (SSTI) vulnerabilities and a safe implementation.
- Clone this repository:
git clone https://github.com/TheWation/PHPSSTI.git
cd PHPSSTI
- Install dependencies:
composer install
Start the PHP application:
php -S localhost:8000
The application will be running at http://localhost:8000/
.
Visit the application in your browser or through tools like curl
or Postman
, providing the username
parameter in the query string. For example:
http://localhost:8000/?username={{10 * 10}}
Output:
Welcome 100!
Note: The default implementation is vulnerable to SSTI.
The safe.php
file has been safeguarded against this type of attack. To verify this, follow the steps below.
http://localhost:8000/safe.php?username={{10 * 10}}
Output:
Welcome {{10 * 10}}!
Visit the application again with different username
parameters to observe the difference.
This application is intentionally vulnerable to demonstrate SSTI. Do not use it in a production environment. Always validate and sanitize user input.
PHPSSTI
is made with โฅ by Wation and it's released under the MIT
license.