Server-side takeover: from input to execution
SSRF, template injection, path traversal, file upload and deserialization - five routes from a parameter you control to code running on the server.
By the end you can
- Make a server fetch a URL you choose, and reach an internal service or a metadata endpoint with it
- Detect template injection with an arithmetic probe and climb from it to a sandbox escape
- Read an arbitrary file through traversal, then convert the read into execution
- Get executable content past an upload filter by satisfying the check and the interpreter separately
- Recognise a serialized blob by its header, and explain what a gadget chain is composed of
- Order these five by what the target's stack makes plausible, rather than by preference
1. Read
SSRF: making the server fetch the flag for you
A CTF web box almost never exposes the thing that holds the flag. Server-side request forgery is how you borrow the server's network position - the features that fetch URLs, the filter bypasses that actually work, and the internal endpoints worth asking for once you are through.
Template injection and the long climb out of a Python jail
{{7*7}} returning 49 is the easy part. What follows is the interesting part: identifying the engine from one probe, then walking Python's object graph from an empty list to os.system with imports, dots, quotes, and underscores taken away from you.
Path traversal and local file inclusion: from ../ to code execution
Getting out of the directory the application meant you to stay in, the filters that try to stop you and why they fail, PHP stream wrappers, and the four routes from reading a file to executing one.
File upload: getting the wrong bytes into the right place
Beating extension checks, MIME checks and magic-byte checks, why a polyglot file is valid twice, and the three things that have to be true before an uploaded file becomes code execution.
Reading serialized blobs, and the gadget chains hiding behind them
How to recognise PHP, Java, Python, .NET, and Node serialized data on sight, edit it by hand when that is enough, and build a property-oriented chain out of the target's own classes when it is not.
2. Use the tools
In the order they come up while solving. Read what each one does, or go straight to the workspace tab that runs it.
- Web attack payload catalog
Curated payloads for SQL injection, XSS, SSTI, SSRF, GraphQL, and deserialization, organised by what you are trying to establish.
Open it in the workspace - HTTP request replayer
Craft and replay HTTP requests with arbitrary methods, headers, and bodies, and read the raw response - a Repeater that runs in your browser.
Open it in the workspace - Reverse shell generator
Generate reverse shell one-liners for bash, nc, Python, Perl, Ruby, PHP, Node, and PowerShell, plus listeners and TTY stabilisation commands.
Open it in the workspace - File type identifier by magic bytes
Drop a file and identify what it really is from its signature, regardless of extension. Also finds file headers embedded inside other files.
Open it in the workspace - Magic byte and file signature table
Look up any file format by its magic bytes, or any byte sequence by format - including the trailers that mark where a file ends.
Open it in the workspace - ZIP archive inspector
Read a ZIP’s central directory and local headers, spot mismatches used to hide files, and check encryption and compression per entry.
Open it in the workspace
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 14 match in total - see the full index.
Common mistakes
The wrong turns this topic reliably produces. Written as the mistake rather than the rule, because the rule is easy to agree with and easy to walk straight past.
- Testing SSRF only against external hosts. The interesting targets are loopback, link-local metadata and the internal names the application already resolves.
- Deciding an upload filter is safe because the extension check works. A file can satisfy a magic-byte check and still be parsed as code by whatever opens it next.
- Treating a pickle or a PHP object as inert data. Deserialization runs code by design, and the gadget usually comes from a library already loaded, not from your payload.
- Concluding there is no SSRF because no response came back. Blind is the common case: a request arriving at a collector you control proves the fetch happened even when the application returns the same error either way.
- Stopping at a traversal that returns a file. The value is in which file - a config holding credentials, a log you can poison, or a process file that leaks the environment - and each of those is the step that converts a read into execution.
Checkpoint
From one user-controlled parameter, produce evidence of code execution on the server - and write the chain down as a sequence of trust boundaries crossed, one line each.
Teaching note
Have students state, before touching anything, what the server would have to be doing for each of the five to be possible. It converts a payload hunt into a reasoning exercise, and it is the only version of this module that transfers to a target the class has not seen.
Go deeper
The lessons above are written to get you through a challenge. These go after the subject instead. Each one opens our notes on that chapter - what it argues, what to take from it and where it stops - so this is somewhere to read now rather than a book to buy first. Nothing here is affiliate-linked or sold by us.
Chapter 13, Server-Side Request Forgery
Bug Bounty Bootcamp - Vickie Li
The filter-bypass catalogue for SSRF, organised by what the filter was trying to do.
Chapter 14, Insecure Deserialization
Bug Bounty Bootcamp - Vickie Li
Gadget chains explained as composition rather than as magic payloads.
Chapter 16, Template Injection
Bug Bounty Bootcamp - Vickie Li
The detection probe and the escape, kept separate, which is the order you need them in.
Chapter 12, Canonicalization Issues
Hunting Security Bugs - Tom Gallagher, Bryan Jeffries, and Lawrence Landauer
Why path traversal keeps coming back: every layer normalises differently, and the checker is rarely the last one.
Every book the curriculum cites has a page in the library.