# Example 1

## Example

Consider the following web page.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2Fiq4RUusa00Djc5i1s8NS%2Fimage.png?alt=media&#x26;token=a2d323f1-1246-4ebb-beb1-434ac7373d0e" alt=""><figcaption></figcaption></figure>

This page shows a basic welcome message along with the name of the user concatenated according to the input in the URL as `http://10.201.75.107:5000/profile/<user>`. Let's try to find an injection point in the `<user>` parameter in the URL.&#x20;

We can brute-force this webpage to check for any special functions but if we have to go manual then we can check with the following set of special characters.  `${{<%[%'"}}%`&#x20;

These characters are often used by template engines (for eg. Jinja)

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FX7wY09Khnij5dlkl5s9F%2Fimage.png?alt=media&#x26;token=2a967c13-595e-4aff-9c1b-f380cbf9a448" alt=""><figcaption></figcaption></figure>

Here we can try to trigger an error on the webpage using these special characters.&#x20;

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FQudN9fWqNhzvTwWhPW0P%2Fimage.png?alt=media&#x26;token=b03e7bd1-2aab-4762-9352-55b68fcce646" alt=""><figcaption></figcaption></figure>

As you can see, using the characters `{{` triggered an Internal Server Error.&#x20;

The reason we are trying to trigger an error using special characters is to detect the template engine being used.&#x20;

We can use the following decision tree to do so.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FfIsiBdrj9Y7E5DZ9sNh8%2Fimage.png?alt=media&#x26;token=bce94309-e08f-4176-9af6-3bc8cc50944c" alt=""><figcaption></figcaption></figure>

We can start from the left-most payload.&#x20;

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2F5srCabDs0PzMhGz0a3xJ%2Fimage.png?alt=media&#x26;token=bc272f6d-df55-49fe-98e2-777265dbf631" alt=""><figcaption></figcaption></figure>

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FeX3g723tYJ97i65UiACc%2Fimage.png?alt=media&#x26;token=a74a540e-9204-4c55-b351-f58875c27c65" alt=""><figcaption></figcaption></figure>

As you can see the payload worked and we now know that Jinja2 is the implemented template engine.&#x20;

## Syntax

Next step is to get aware of the engine's syntax. The best way to do so is to check out the official documentation.

Always look for the following, no matter the language or template engine:

* How to start a print statement
* How to end a print statement
* How to start a block statement
* How to end a block statement
