🧱 Client-Side Template Injection

What it is

Every injection bug is the same shape: a string you control gets glued into something that an interpreter later parses. SQL, NoSQL, XML, templates and XPath differ only in which interpreter you are talking to and which syntax breaks it.

How I attack it

1. Probe with the syntax of the language, not with a payload list. A quote, a brace, a bracket - whatever that parser treats as special.
2. An error is a gift, but no error is not a no. Compare response time, length and behaviour between a true and a false condition.
3. Once you can influence the query, work out what the interpreter can reach: other tables, the filesystem, the template's object graph, an outbound request.
4. Template injection and XXE regularly end in command execution or file read, so escalate before you report.

Learn it from The XSS Rat

Free reference reading