{"id":"ada3bc4f-f0fd-42b9-ba91-e105e8af7342","title":"Server Side Template Injection Strings","description":"Detects SSTI attempts sent via GET requests in access logs","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-14","modified":"","tags":["attack.stealth","attack.t1221"],"technique_ids":["T1221"],"logsource":{"category":"webserver"},"falsepositives":["User searches in search boxes of the respective website","Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as \"User Agent\" strings and more response codes"],"references":["https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection","https://github.com/payloadbox/ssti-payloads"],"source_path":"rules/web/webserver_generic/web_ssti_in_access_logs.yml","source_sha256":"44d968cd9205bb30f04ada63c54cf4c01a69f1f69a4e60fcdcf7aca305be2054","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_ssti_in_access_logs.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Server Side Template Injection Strings\nid: ada3bc4f-f0fd-42b9-ba91-e105e8af7342\nstatus: test\ndescription: Detects SSTI attempts sent via GET requests in access logs\nreferences:\n    - https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection\n    - https://github.com/payloadbox/ssti-payloads\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-06-14\ntags:\n    - attack.stealth\n    - attack.t1221\nlogsource:\n    category: webserver\ndetection:\n    select_method:\n        cs-method: 'GET'\n    keywords:\n        - '={{'\n        - '=%7B%7B'\n        - '=${'\n        - '=$%7B'\n        - '=<%='\n        - '=%3C%25='\n        - '=@('\n        - 'freemarker.template.utility.Execute'\n        - .getClass().forName('javax.script.ScriptEngineManager')\n        - 'T(org.apache.commons.io.IOUtils)'\n    filter:\n        sc-status: 404\n    condition: select_method and keywords and not filter\nfalsepositives:\n    - User searches in search boxes of the respective website\n    - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as \"User Agent\" strings and more response codes\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1221","id":"T1221","name":"Template Injection","page":"techniques/enterprise/T1221/"}],"data_path":"data/detection-rules/ada3bc4f-f0fd-42b9-ba91-e105e8af7342.json","kind":"sigma"}