> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-ssti-labs/lab-1.md).

# lab-1

## Basic Server-Side Template Injection (ERB)

**Difficulty:** Practitioner

### Lab Description

This lab is vulnerable to server-side template injection due to the unsafe construction of an ERB template.

**Objective:** Review the ERB documentation to find out how to execute arbitrary code, then delete the `morale.txt` file from Carlos's home directory.

### Solution

**Step 1 — Spot the anomaly**

Clicking on certain products shows the message *"Unfortunately this product is out of stock."* This message doesn't appear for every product. Passing the `productId` parameter through Burp Intruder across all available product IDs confirms the behavior is inconsistent — a sign that something is being evaluated rather than just looked up.

**Step 2 — Confirm template injection**

The "out of stock" message is suspicious because it appears to reflect input differently depending on the product. Capture the relevant request and send it to Intruder, then try different template-engine syntaxes to look for errors or unexpected output. Since the lab description already tells us the backend is using **ERB** (Ruby's templating engine), test directly with:

```erb
<%= 7*7 %>
```

URL-encode this and send it. If the response reflects `49`, server-side template injection is confirmed.

**Step 3 — Find a code-execution primitive**

The goal is to delete a file, so a function or class capable of executing OS commands is needed. A quick search of ERB/Ruby documentation suggests enumerating `Kernel` methods related to command execution:

```erb
<%= Kernel.methods.grep(/exec|system|spawn|fork|`/) %>
```

This returns the methods available in the current environment for executing system commands.

**Step 4 — Identify usable methods and exploit**

The output includes:

```
[:exec, :system, :spawn, :fork, :`, :module_exec, :class_exec, :instance_exec]
```

Backticks (`` ` ``) are one of the simplest ways to run OS commands in Ruby. URL-encode and send the following payload to delete the target file:

```erb
<%= `rm /home/carlos/morale.txt` %>
```

### Conclusion

The application unsafely embedded user input directly into an ERB template, allowing arbitrary Ruby code — and by extension, arbitrary OS commands — to be executed on the server.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-ssti-labs/lab-1.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.