search

Client Side Template Injection

hashtag
Check List

hashtag
Methodology

hashtag
Black Box

hashtag
Search Box

1

Go to any search box on the target

2

Enter this exact payload in the input field

{{7*7}}
3

Submit the form or trigger the search

4

Check the response or rendered page

5

If you see 49, Client-Side Template Injection (CSTI) CONFIRMED

6

Escalate immediately with this XSS payload

{{constructor.constructor('alert(document.domain)')()}}
7

If alert pops, Full XSS via CSTI, CONFIRMED

of

javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*&lt;svg/*/onload=alert(document.domain)//>

hashtag
CSTI in the registration process

1

Log in to the target site and complete the account creation process

2

Then trace the request process using Burp Suite

3

In the intercepted request from the account creation process, replace and fill in the username form using the payload below and submit the request

“>{{7*7}}<img>
4

After creating the account, if the username field contains 49, the vulnerability is confirmed

5

Then we can convert this vulnerability to XSS using the following command

{{constructor.constructor(‘alert(`XSS`)’)()}}

hashtag
White Box

hashtag
Cheat Sheet

PreviousCross Origin Resource SharingNextCross Site Flashing

Last updated