Skip to content
All modules
AdvancedModule 14 of 27120 minutes

Server-side takeover: from input to execution

SSRF, template injection, path traversal, file upload and deserialization - five routes from a parameter you control to code running on the server.

Assumes11. Injection: SQL and everything after it

By the end you can

  • Make a server fetch a URL you choose, and reach an internal service or a metadata endpoint with it
  • Detect template injection with an arithmetic probe and climb from it to a sandbox escape
  • Read an arbitrary file through traversal, then convert the read into execution
  • Get executable content past an upload filter by satisfying the check and the interpreter separately
  • Recognise a serialized blob by its header, and explain what a gadget chain is composed of
  • Order these five by what the target's stack makes plausible, rather than by preference

1. Read

2. Use the tools

In the order they come up while solving. Read what each one does, or go straight to the workspace tab that runs it.

3. Try one now

Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.

4. Practise on the real thing

Real picoCTF challenges that use these techniques, easiest first. 15 match in total - see the full index.

Common mistakes

The wrong turns this topic reliably produces. Written as the mistake rather than the rule, because the rule is easy to agree with and easy to walk straight past.

  • Testing SSRF only against external hosts. The interesting targets are loopback, link-local metadata and the internal names the application already resolves.
  • Deciding an upload filter is safe because the extension check works. A file can satisfy a magic-byte check and still be parsed as code by whatever opens it next.
  • Treating a pickle or a PHP object as inert data. Deserialization runs code by design, and the gadget usually comes from a library already loaded, not from your payload.
  • Concluding there is no SSRF because no response came back. Blind is the common case: a request arriving at a collector you control proves the fetch happened even when the application returns the same error either way.
  • Stopping at a traversal that returns a file. The value is in which file - a config holding credentials, a log you can poison, or a process file that leaks the environment - and each of those is the step that converts a read into execution.

Checkpoint

From one user-controlled parameter, produce evidence of code execution on the server - and write the chain down as a sequence of trust boundaries crossed, one line each.

Teaching note

Have students state, before touching anything, what the server would have to be doing for each of the five to be possible. It converts a payload hunt into a reasoning exercise, and it is the only version of this module that transfers to a target the class has not seen.

Go deeper

The lessons above are written to get you through a challenge. These are the chapters to read when you want the subject instead - each one named so you can check it rather than take our word for it. Nothing here is affiliate-linked or sold by us.

  • Bug Bounty Bootcamp - Vickie Li

    Chapter 13, Server-Side Request Forgery

    The filter-bypass catalogue for SSRF, organised by what the filter was trying to do.

  • Bug Bounty Bootcamp - Vickie Li

    Chapter 14, Insecure Deserialization

    Gadget chains explained as composition rather than as magic payloads.

  • Bug Bounty Bootcamp - Vickie Li

    Chapter 16, Template Injection

    The detection probe and the escape, kept separate, which is the order you need them in.

  • Hunting Security Bugs - Tom Gallagher, Bryan Jeffries, and Lawrence Landauer

    Chapter 12, Canonicalization Issues

    Why path traversal keeps coming back: every layer normalises differently, and the checker is rarely the last one.