SSTI (Server-Side Template Injection)

Recursos cross-platform para SSTI (Server-Side Template Injection): máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

Esta página agrega los recursos para practicar SSTI (Server-Side Template Injection) de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

Cobertura: 24 retos en 3 plataformas — 12 HackTheBox · 7 PortSwigger · 5 TryHackMe. 12 con writeup en español, 12 con writeup en vídeo.

​

Por dónde empezar

Ordenado por dificultad real. A igual nivel, primero el lab aislado, después la room guiada y por último la máquina completa.

1. PortSwigger — Server-side template injection in a sandboxed environment (Apprentice) · 🇬🇧
2. PortSwigger — Server-side template injection with a custom exploit (Apprentice) · 🇬🇧
3. TryHackMe — OWASP Top 10 2025: Insecure Data Handling (Easy · ~30 min) · 🇬🇧
4. HackTheBox — Doctor (Fácil) · 🇪🇸 🇬🇧 📹
5. HackTheBox — GoodGames (Fácil) · 🇪🇸 🇬🇧 📹
6. HackTheBox — Late (Fácil) · 🇪🇸 🇬🇧 📹

​

Recursos curados

Fuente	Enlace
PortSwigger	https://portswigger.net/web-security/server-side-template-injection

​

Máquinas HTB que practican SSTI (Server-Side Template Injection) (12)

Máquina	SO	Dificultad	Writeup
Anubis	Windows	INSANE	🇪🇸 🇬🇧 📹
Bolt	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Catch	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Doctor	Linux	EASY	🇪🇸 🇬🇧 📹
Epsilon	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Flustered	Linux	MEDIUM	🇪🇸 🇬🇧 📹
GoodGames	Linux	EASY	🇪🇸 🇬🇧 📹
Hancliffe	Windows	HARD	🇪🇸 🇬🇧 📹
Late	Linux	EASY	🇪🇸 🇬🇧 📹
Noter	Linux	MEDIUM	🇪🇸 🇬🇧 📹
NunChucks	Linux	EASY	🇪🇸 🇬🇧 📹
Oz	Linux	HARD	🇪🇸 🇬🇧 📹

​

Labs PortSwigger que practican SSTI (Server-Side Template Injection) (7)

Lab	Dificultad	Topic	Oficial
Server-side template injection in a sandboxed environment	APPRENTICE	Server-Side Template Injection (SSTI)	Abrir
Server-side template injection with a custom exploit	APPRENTICE	Server-Side Template Injection (SSTI)	Abrir
Basic server-side template injection	PRACTITIONER	Server-Side Template Injection (SSTI)	Abrir
Basic server-side template injection (code context)	PRACTITIONER	Server-Side Template Injection (SSTI)	Abrir
Server-side template injection in an unknown language with a documented exploit	PRACTITIONER	Server-Side Template Injection (SSTI)	Abrir
Server-side template injection using documentation	PRACTITIONER	Server-Side Template Injection (SSTI)	Abrir
Server-side template injection with information disclosure via user-supplied objects	PRACTITIONER	Server-Side Template Injection (SSTI)	Abrir

​

Rooms TryHackMe que practican SSTI (Server-Side Template Injection) (5)

Room	Dificultad	Tipo	Acceso	Oficial
OWASP Top 10 2025: Insecure Data Handling	EASY	Walkthrough	🟢 Free	Abrir
Hip Flask	MEDIUM	Walkthrough	🟢 Free	Abrir
NoNameCTF	MEDIUM	Challenge	🔵 VIP	Abrir
Server-side Template Injection	MEDIUM	Walkthrough	🔵 VIP	Abrir
SSTI	MEDIUM	Walkthrough	🟢 Free	Abrir

​

Skills relacionadas

• /skills/rce

---

← Volver al glosario completo

Última actualización: 2026-08-17