> For the complete documentation index, see [llms.txt](https://rayyanwong.gitbook.io/rayyan/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rayyanwong.gitbook.io/rayyan/ctfs/lag-n-crash-2022-march/lnc2022-writeups/outline-1-web-exploitation.md).

# Outline 1 ( Web exploitation )

Challenge: Outline 1

Upon connecting to the server, we are greeted with this login page.

![](https://1548390168-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMePZib3zSv2WjhGvbhgS%2Fuploads%2FfKXpomwX3xMSnSQNWxiE%2Fimage.png?alt=media\&token=f8666cd6-ce7f-44c3-821c-dad335df4172)

I decided to register an account with username "r" and password "r" and logged in into the account. Which led me to this page.

![](https://1548390168-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMePZib3zSv2WjhGvbhgS%2Fuploads%2FylmwIjvelNzs5uta6M9U%2Fimage.png?alt=media\&token=ff8b4363-a27e-446f-a432-89bfe0fd681f)

Tested for SSTI vulnerability with {{7\*7}} payload.

![](https://1548390168-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMePZib3zSv2WjhGvbhgS%2Fuploads%2F7Iunf5WiuySJXEYEqvee%2Fimage.png?alt=media\&token=a7a01596-7ba4-4138-8e8c-12703abdb1f1)

This was the result from the payload `{{7*7}}`

![](https://1548390168-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMePZib3zSv2WjhGvbhgS%2Fuploads%2FFCQsXsu2KiealqlQXzIV%2Fimage.png?alt=media\&token=be0d2801-1d56-40ee-b014-952a4fbf6b8d)

Replaced the payload `{{config}}`

![](https://1548390168-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMePZib3zSv2WjhGvbhgS%2Fuploads%2FPnHiJTRQsGj43fFYjS7n%2Fimage.png?alt=media\&token=5a5e131e-a3e2-468d-add0-f26ee9ea2f0e)

Looking at 'SECRET\_KEY' the flag is given there :)!

<mark style="color:blue;">**`LNC2022{s1mpl3_fl4sk_s3rv3r_s1d3_t3mpl4t3_1nj3c10n}`**</mark>