Classroom Glossary Public page

Lab Pack 3: Generic Jinja2 SSTI in Flask (Week 3)

Reproduce a generic Jinja2 SSTI in a Flask app. The anchor lab for the rest of the course; without it, Module 4 reads as mysterious-LangChain-stuff.

What you ship

  • A small Flask app that renders user input through Jinja2.
  • A walkthrough showing {{7*7}} returning 49, then escalating through the canonical payload library.
  • A short README naming the Flask + Jinja2 versions pinned.
  • A Toolchain Diary entry for Flask + Jinja2.

Tools you use

  • Flask in a clean virtualenv (cohort-pinned).
  • Burp Suite Community or your browser's network panel.
  • The PortSwigger SSTI cheatsheet as a payload reference.

Success criteria

  • The Flask app actually starts and accepts input.
  • {{7*7}} returns 49 in the rendered output.
  • At least one escalation payload from the canonical library fires.

Time budget

Plan for two ninety-minute lab sessions plus two hours of independent build-out. Modules 4 and 6 commonly run over; budget one extra session for those.

Submission

Push to your student repo under adv-102/labs/lab-3/. Include source, a one-paragraph README, the output you observed, and where applicable a structured detector or trace file.