## Challenge InfoWeb challenge `http://chall.csivit.com:30279/` , we have a Tornado application vulnerable to server side template injection SSTI. First we need to leak the cookie_secret using ssti and regenrate a cookie with `admin: true ` to get the flag.
## Writeup summary- Gain general informations- exploit the ssti parameter and leak the secret - regenerate a tornado cookie
### Gain general informationsWhen we visit the website we got a page with a form to submit an ice-cream flavours:
 
the request look like `http://chall.csivit.com:30279/?icecream={{chocolate}}` it lead us to consider the possibility of an SSTI attack in icecream parameter.
### Exploit the ssti parameter and leak the secret
first we tried this basic payload `{{7*'7'}}` : 
this confirmed our thoughts of this website being vulnerable to ssti attack , next we tried to get the config by sending this url  `http://chall.csivit.com:30279/?icecream={{config}}` but the server returned an exception :
 
from this exception we knew that the server used here was Tornado, which is an asynchronous python web server. Back to the documentation, wenoticed that tornado.web.Application use `settings` dictionary as a way to make application-specific settings like `cookie_secret` available to handlers without using global variables [tornado settings](https://www.tornadoweb.org/en/stable/web.html#tornado.web.Application.settings)
visiting ` http://chall.csivit.com:30279/?icecream={{globals()}} ` and we got :
 
we know that the name of the variable `tornado.web.Application()` is `application` so the final payload to get the secret was `?icecream={{application.settings["cookie_secret"]}}` and we had the value `MangoDB`  displayed on the website.
## Regenerate a tornado cookies :
Signed cookies in tornado apps contain the encoded value of the cookie with a timestamp and an HMAC signature [from github](https://github.com/tornadoweb/tornado/blob/master/tornado/web.py#L3349).We regenerate the new cookie with required value `true` to get the flag `csictf{h3r3_i_4m}`, check out the [forge_tornado.py](forge_tornado.py).