Member-only story
How I Made $300 in 5 Minutes💰
🚀Free Article Link
Hello, everyone! 👋
I’m Abhijeet Kumawat, a passionate security researcher 🕵️♂️, and today, I’m excited to share a recent vulnerability. This is the story of how I discovered a Server-Side Template Injection (SSTI) vulnerability 🔒in self-hosted website — and earned a $300 bounty in the process.Here’s how it happened.
🧐 What is SSTI?
Server-Side Template Injection (SSTI) occurs when an attacker can inject malicious input into a server-side template, causing the server to execute unintended commands. Many web frameworks use templates to dynamically render web pages. If the input fields in these templates are not properly sanitized, attackers can execute arbitrary code, extract sensitive data, or even take control of the server.
🕵️♂️The Discovery
The Setup
While testing a self-hosted website, I noticed a signup form. Here’s what I did:
