Flask SSTI Lab

A deliberately vulnerable Flask application created as a cybersecurity training project. The goal is to identify a Server-Side Template Injection (SSTI) flaw in a fictional intelligence portal and retrieve the lab flag.

The portal, organizations, people, and records shown in the application are fictional. This project is not affiliated with any real institution.

• Recognize unsafe use of Jinja's render_template_string
• Confirm SSTI with a harmless expression
• Explore the template context and retrieve the lab flag
• Understand why untrusted input must never be treated as a template

Docker is the recommended way to run the lab.

docker build -t flask-ssti-lab .
docker run --rm --read-only --cap-drop=ALL --security-opt=no-new-privileges \
  -p 127.0.0.1:5000:5000 flask-ssti-lab

Open http://127.0.0.1:5000.

Your first objective is to discover the login credentials from the clues exposed by the application. After signing in, start with the harmless payload {{ 7 * 7 }} on the personnel search page. The remaining discovery is intentionally left to the learner.

python -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements-dev.txt
python -m flask --app app run

On Windows PowerShell, activate the environment with .venv\Scripts\Activate.ps1.

python -m pytest

The test suite documents the intended vulnerability and checks that unrelated reflected XSS is not introduced.

There is exactly one intentional vulnerable sink, marked INTENTIONALLY VULNERABLE in app.py. Everything else should be treated as ordinary application code and reported if it behaves unexpectedly.

Released under the MIT License.