> For the complete documentation index, see [llms.txt](https://rayyanwong.gitbook.io/rayyan/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rayyanwong.gitbook.io/rayyan/ctfs/lag-n-crash-2022-march/lnc2022-writeups/echo-web-exploitation.md).

# Echo ( Web exploitation )

## Some links for referrence to help me solve this question

* <https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection>
* <https://medium.com/@nyomanpradipta120/ssti-in-flask-jinja2-20b068fdaeee>

Finding a way to get out of the “echo” function

* Hint given is : template
* Tried SSTI&#x20;
* When trying one of the templates, it listed all the files inside of the flask
* Change the command instead of ‘ls’ to ‘cat flag’

<mark style="color:blue;">**`LNC2022{s3rv3r_s1d3_t3mplAte_Inj3ct10n_i5_fUn}`**</mark><br>