Most modern web applications render output from templates — a fixed layout combined with variable data. A template engine is the library that fills in those placeholders at request time, turning a pattern like Hello {{name}} into Hello Alice before the server sends the response. Where that combining happens decides how dangerous a template flaw is.
- When the browser holds the template and binds data into it, rendering is client-side (Angular, React, Vue). A flaw here is a browser problem, usually cross-site scripting.
- When the server holds the template and the template engine runs inside the server process, rendering is server-side (Pug, Handlebars, EJS, Nunjucks, Jinja2, Twig). A flaw here lets attacker input be evaluated inside the server, which can lead all the way to remote code execution.
Server-side template injection (SSTI) is the second case: untrusted input is embedded into a server-side template and interpreted as template code rather than treated as data. It sits under A03:2021 - Injection.
In this lesson you will:
- Distinguish client-side output from server-side template rendering.
- Fingerprint a template engine with a polyglot probe.
- Read the evaluated result as the signature that separates SSTI from reflected XSS.
- Understand the escalation from expression evaluation to remote code execution, and the durable fix.
Terminology: throughout the injection lessons, a sink is the point in server code where untrusted input meets a sensitive interpreter. In SSTI that interpreter is the template engine; in the SQL injection lesson it was the query builder. If you jumped here from lesson 1 (the recommended path when DVWA is not yet set up), this term was introduced in that lesson's intro — later steps in this lesson refer to "locating the sink."
Estimated time: 10 to 15 minutes.
Note on the target: this lesson uses the custom Template Sink Tracer and Probe Lab in the right panel, so no external target is required. You may alternatively practise against the PortSwigger Web Security Academy "Basic SSTI" lab or another server-side templating endpoint you are authorised to test.
Scope reminder: use the right-panel simulation, the PortSwigger lab, or another target you have explicit permission to test. Attempting template injection on a system you do not own constitutes unauthorised access and is illegal in most jurisdictions.
When you are ready, send the Continue signal.