Maths that shouldn't happen
The greeting page at /app/greet puts your name into the reply. Give it a normal name and you get a normal greeting:
curl -sg 'http://127.0.0.1:8080/app/greet?name=Alice'In the terminal
student@vulntech:~$ curl -sg 'http://127.0.0.1:8080/app/greet?name=Alice' <!doctype html><title>Greeting</title><p>Hello, Alice!</p>
But the name isn't just inserted into text — it's built into a template that the server then renders. Send it template syntax and the server evaluates it. The classic probe is a bit of arithmetic:
curl -sg 'http://127.0.0.1:8080/app/greet?name={{7*7}}'In the terminal
student@vulntech:~$ curl -sg 'http://127.0.0.1:8080/app/greet?name={{7*7}}' <!doctype html><title>Greeting</title><p>Hello, 49!</p>
{{7*7}} came back as 49. Plain string handling could never do that; the server ran your expression. That's server-side template injection. (We pass curl -g so curl leaves the {} alone instead of treating them as a URL glob.)