NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
GreetGen makes personalised greeting cards by formatting your name into a Jinja2 template string. Confirm your input is executed, then reach into Python to read the flag.
#ssti#jinja2#rce#web
DifficultyMedium
Live Environment
Ready
Spin up your own private, isolated instance of this challenge.
Auto shutdown after 60 minutes
Isolated sandbox
Captured flags are saved independently of the environment
One-click restart
Submit Flag
Hints
Unlocking any hint — including free ones — forfeits the +25% no-hint solve bonus.
SSTI happens when user input is inserted into a template that the server evaluates, letting attackers run template expressions and sometimes reach code execution.
How can you detect SSTI?
Send harmless expressions such as {{7*7}} and see whether the result is evaluated. A computed output suggests the input reaches the template engine.
How is SSTI prevented?
Never build templates from user input; pass data as variables, use sandboxed rendering where possible, and keep engines updated. GreetGen is free on Codelivly.