BSides Vancouver 2026

Server Side Template Injection (SSTI) is a web vulnerability that can be hard to spot, but leads to critical consequences when exploited.  While this class of vulnerability has been documented for more than a decade, new research is constantly demonstrating that this is not a solved problem.  New techniques for finding and exploiting SSTI vulnerabilities made the #1 spot for the 2025 top web security vulnerability rankings.

This presentation will cover how to discover SSTI vulnerabilities (even "blind" ones), and how these can be exploited to gain full code execution on the underlying server.  No existing knowledge needed, SSTI's for everyone!