# Server Side Inclusion/Edge Side Inclusion Injection
Support HackTricks and get benefits! * Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
## Server Side Inclusion Basic Information SSI (Server Side Includes) are directives that are **placed in HTML pages, and evaluated on the server** while the pages are being served. They let you **add dynamically generated content** to an existing HTML page, without having to serve the entire page via a CGI program, or other dynamic technology.\ For example, you might place a directive into an existing HTML page, such as: `` And, when the page is served, this fragment will be evaluated and replaced with its value: `Tuesday, 15-Jan-2013 19:28:54 EST` The decision of when to use SSI, and when to have your page entirely generated by some program, is usually a matter of how much of the page is static, and how much needs to be recalculated every time the page is served. SSI is a great way to add small pieces of information, such as the current time - shown above. But if a majority of your page is being generated at the time that it is served, you need to look for some other solution. (Definition taken from [here](https://httpd.apache.org/docs/current/howto/ssi.html)). You can infer the presence of SSI if the web application uses files with the extensions ** `.shtml`, `.shtm` or `.stm`**, but it's not only the case. A typical SSI expression has the following format: ``` ``` ### Check ```javascript // Document name // Date // File inclusion // Including files (same directory) // CGI Program results // Including virtual files (same directory) // Modification date of a file // Command exec // Command exec // Reverse shell // Print all variables // Setting variables ``` ## Edge Side Inclusion There is a problem **caching information or dynamic applications** as part of the content may have **varied** for the next time the content is retrieved. This is what **ESI** is used form, to indicate using ESI tags the **dynamic content that needs to be generated** before sending the cache version.\ if an **attacker** is able to **inject an ESI tag** inside the cache content, then, he could be able to i**nject arbitrary content** on the document before it's sent to the users. ### ESI Detection The following **header** in a response from the server means that the server is using ESI: ``` Surrogate-Control: content="ESI/1.0" ``` If you can't find this header, the server might be using ESI anyways.\ A **blind exploitation approach can also be used** as a request should arrive to the attackers server: ```javascript // Basic detection > // Cookie Stealer (bypass httpOnly flag) // Introduce private local files (Not LFI per se) // Valid for Akamai, sends debug information in the response ``` ### ESI exploitation [GoSecure](https://www.gosecure.net/blog/2018/04/03/beyond-xss-edge-side-include-injection/) has created a table to help us understand possible attacks that we can try against different ESI-capable software, depending on the functionality supported. Let us provide some explanations regarding the column names of the below table first: * **Includes**: Supports the `` directive * **Vars**: Supports the `` directive. Useful for bypassing XSS Filters * **Cookie**: Document cookies are accessible to the ESI engine * **Upstream Headers Required**: Surrogate applications will not process ESI statements unless the upstream application provides the headers * **Host Allowlist**: In this case, ESI includes are only possible from allowed server hosts, making SSRF, for example, only possible against those hosts | **Software** | **Includes** | **Vars** | **Cookies** | **Upstream Headers Required** | **Host Whitelist** | | :--------------------------: | :----------: | :------: | :---------: | :---------------------------: | :----------------: | | Squid3 | Yes | Yes | Yes | Yes | No | | Varnish Cache | Yes | No | No | Yes | Yes | | Fastly | Yes | No | No | No | Yes | | Akamai ESI Test Server (ETS) | Yes | Yes | Yes | No | No | | NodeJS esi | Yes | Yes | Yes | No | No | | NodeJS nodesi | Yes | No | No | No | Optional | #### XSS The following ESI directive will load an arbitrary file inside the response of the server ```markup ``` The file _http://attacker.com/xss.html_ may contain a XSS payload like `` #### Bypass client XSS protection ```markup x=>alert(/Chrome%20XSS%20filter%20bypass/);> ``` #### Steal Cookie ```markup ``` #### Private Local File Do not confuse this with a "Local File Inclusion": ```markup ``` #### CRLF ```markup ``` #### Add Header ```html ``` #### CRLF in Add header (**CVE-2019-2438)** **** ```markup ``` #### Akamai debug This will send debug information included in the response: ```markup ``` ### ESI + XSLT = XXE It is also possible to add \*\* **\_**eXtensible Stylesheet Language Transformations (XSLT)**\_** \*\* based ESI includes by specifying the `xslt` value to the _dca_ parameter. The following include will cause the HTTP surrogate to request the XML and XSLT file. The XSLT file is then used to filter the XML file. This XML file can be used to perform _XML External Entity (XXE)_ attacks. This allows attackers to perform SSRF attacks, which is not very useful since this must be performed through ESI includes, which is an SSRF vector itself. External DTDs are not parsed since the underlying library (Xalan) has no support for it. This means we cannot extract local files. ```markup ``` The XSLT file: ```markup ]> &xxe; ``` Check the XSLT page: {% content-ref url="xslt-server-side-injection-extensible-stylesheet-languaje-transformations.md" %} [xslt-server-side-injection-extensible-stylesheet-languaje-transformations.md](xslt-server-side-injection-extensible-stylesheet-languaje-transformations.md) {% endcontent-ref %} ### References * [https://www.gosecure.net/blog/2018/04/03/beyond-xss-edge-side-include-injection/](https://www.gosecure.net/blog/2018/04/03/beyond-xss-edge-side-include-injection/) * [https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/](https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/) * [https://academy.hackthebox.com/module/145/section/1304](https://academy.hackthebox.com/module/145/section/1304) ## Brute-Force Detection List {% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/ssi_esi.txt" %}
Support HackTricks and get benefits! * Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**