How SSTI works
Greetings that evaluate: from {{7*7}} to server config.
Templates render pages from data: Hello, {{name}}. When user input reaches the template engine unsanitized, template syntax inside the input evaluates. {{7*7}} rendering as 49 is the standard probe — arithmetic cannot happen in plain text, so 49 proves evaluation.
Impact follows the engine's power. Simple engines stop at math and attribute reads; full engines expose objects, methods, and the filesystem, turning a name field into remote code execution. Detection is the same math probe everywhere; exploitation is engine-specific, which is why identifying the engine (error messages, syntax quirks) comes right after proving evaluation.
The fix: never concatenate input into templates. Pass user data as variables the template displays, never as template source. Logic-less templates that cannot call methods shrink even a miss into a non-event.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.