Server-side takeover: from input to execution

Before the session

• Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
• Read the lesson yourself first - about 43 minutes.
• Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.

Objectives

Written as things a student can do afterwards, so they can be assessed rather than asserted.

1. Make a server fetch a URL you choose, and reach an internal service or a metadata endpoint with it
2. Detect template injection with an arithmetic probe and climb from it to a sandbox escape
3. Read an arbitrary file through traversal, then convert the read into execution
4. Get executable content past an upload filter by satisfying the check and the interpreter separately
5. Recognise a serialized blob by its header, and explain what a gadget chain is composed of
6. Order these five by what the target's stack makes plausible, rather than by preference

Running order (120 min)

Tools used

• Web attack payload catalog - Curated payloads for SQL injection, XSS, SSTI, SSRF, GraphQL, and deserialization, organised by what you are trying to establish.https://ctfpal.com/?tool=payload-catalog
• HTTP request replayer - Craft and replay HTTP requests with arbitrary methods, headers, and bodies, and read the raw response - a Repeater that runs in your browser.https://ctfpal.com/?tool=http-request-replayer
• Reverse shell generator - Generate reverse shell one-liners for bash, nc, Python, Perl, Ruby, PHP, Node, and PowerShell, plus listeners and TTY stabilisation commands.https://ctfpal.com/?tool=reverse-shell-generator
• File type identifier by magic bytes - Drop a file and identify what it really is from its signature, regardless of extension. Also finds file headers embedded inside other files.https://ctfpal.com/?tool=file-signature-identifier
• Magic byte and file signature table - Look up any file format by its magic bytes, or any byte sequence by format - including the trailers that mark where a file ends.https://ctfpal.com/?tool=magic-byte-lookup
• ZIP archive inspector - Read a ZIP’s central directory and local headers, spot mismatches used to hide files, and check encryption and compression per entry.https://ctfpal.com/?tool=zip-archive-inspector

Reading

• SSRF: making the server fetch the flag for you - 11 min. A CTF web box almost never exposes the thing that holds the flag. Server-side request forgery is how you borrow the server's network position - the features that fetch URLs, the filter bypasses that actually work, and the internal endpoints worth asking for once you are through.
• Template injection and the long climb out of a Python jail - 9 min. {{7*7}} returning 49 is the easy part. What follows is the interesting part: identifying the engine from one probe, then walking Python's object graph from an empty list to os.system with imports, dots, quotes, and underscores taken away from you.
• Path traversal and local file inclusion: from ../ to code execution - 8 min. Getting out of the directory the application meant you to stay in, the filters that try to stop you and why they fail, PHP stream wrappers, and the four routes from reading a file to executing one.
• File upload: getting the wrong bytes into the right place - 6 min. Beating extension checks, MIME checks and magic-byte checks, why a polyglot file is valid twice, and the three things that have to be true before an uploaded file becomes code execution.
• Reading serialized blobs, and the gadget chains hiding behind them - 9 min. How to recognise PHP, Java, Python, .NET, and Node serialized data on sight, edit it by hand when that is enough, and build a property-oriented chain out of the target's own classes when it is not.

Practice set

Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.

1. n0s4n1ty 1 - picoCTF 2025, easy
2. SSTI1 - picoCTF 2025, easy
3. Forbidden Paths - picoCTF 2022, medium
4. Secrets - picoCTF 2022, medium
5. Specialer - picoCTF 2023, medium
6. SSTI2 - picoCTF 2025, medium
7. Startup Company - picoCTF 2021, medium
8. Super Serial - picoCTF 2021, medium
9. Trickster - picoCTF 2024, medium
10. babygame03 - picoCTF 2024, hard
11. Bithug - picoCTF 2021, hard
12. cancri-sp - picoCTF 2023, hard

Checkpoint (gradeable)

From one user-controlled parameter, produce evidence of code execution on the server - and write the chain down as a sequence of trust boundaries crossed, one line each.

Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.

Where the room gets stuck

Have students state, before touching anything, what the server would have to be doing for each of the five to be possible. It converts a payload hunt into a reasoning exercise, and it is the only version of this module that transfers to a target the class has not seen.

• Testing SSRF only against external hosts. The interesting targets are loopback, link-local metadata and the internal names the application already resolves.
• Deciding an upload filter is safe because the extension check works. A file can satisfy a magic-byte check and still be parsed as code by whatever opens it next.
• Treating a pickle or a PHP object as inert data. Deserialization runs code by design, and the gadget usually comes from a library already loaded, not from your payload.
• Concluding there is no SSRF because no response came back. Blind is the common case: a request arriving at a collector you control proves the fetch happened even when the application returns the same error either way.
• Stopping at a traversal that returns a file. The value is in which file - a config holding credentials, a log you can poison, or a process file that leaks the environment - and each of those is the step that converts a read into execution.

If a student wants the subject, not the answer

Chapter-level references, so a student can be pointed at twenty pages rather than at a book. Nothing here is required to complete the module.

• Bug Bounty Bootcamp, Vickie Li. Chapter 13, Server-Side Request Forgery. The filter-bypass catalogue for SSRF, organised by what the filter was trying to do.
• Bug Bounty Bootcamp, Vickie Li. Chapter 14, Insecure Deserialization. Gadget chains explained as composition rather than as magic payloads.
• Bug Bounty Bootcamp, Vickie Li. Chapter 16, Template Injection. The detection probe and the escape, kept separate, which is the order you need them in.
• Hunting Security Bugs, Tom Gallagher, Bryan Jeffries, and Lawrence Landauer. Chapter 12, Canonicalization Issues. Why path traversal keeps coming back: every layer normalises differently, and the checker is rarely the last one.

If you finish early

• Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
• Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
• Ask a student to break their own example - construct an input that defeats the tool, and explain why.