# Freemarker

## Syntax

FreeMarker uses the [**FreeMarker Template Language (FTL)**](https://freemarker.apache.org/docs/dgui_template_overallstructure.html) which consists of text, interpolation, FTL tags, and comments.

```ftl
<html>[BR]
<head>[BR]
  <title>Welcome!</title>[BR]
</head>[BR]
<body>[BR]
  <#-- Greet the user with his/her name -->[BR]
  <h1>Welcome ${user}!</h1>[BR]
  <p>We have these animals:[BR]
  <ul>[BR]
  <#list animals as animal>[BR]
    <li>${animal.name} for ${animal.price} Euros[BR]
  </#list>[BR]
  </ul>[BR]
</body>[BR]
</html>
```

FreeMarker auto-escapes variables if the content type is an HTML document, while most other templating engines always escape HTML content unless specified not to. This make FreeMarker more susceptile to HTML injection (Figure 1.1) and XSS attacks (Figure 1.2).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FrSsikuWgiqeEOPPVVQNJ%2Fweb_ssti_freemarker_syntax.png?alt=media&#x26;token=ef38a145-21c2-489a-a24b-f0ec4764b2b1" alt=""><figcaption><p>Figure 1: Testing HTML injection and XSS in FreeMarker.</p></figcaption></figure>

Unlike PHP used in [Twig](#twig), Java uses cares about data types so if an integer is multiplied with a string, we expect to get an error (Figure 2).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FyCWZuxc8kEKdv8aswJzX%2Fweb_ssti_freemarker_syntax_1.png?alt=media&#x26;token=4bc0002d-bb61-44a8-a3b8-43aadad452ab" alt=""><figcaption><p>Figure 2: Intentionally inducing an error.</p></figcaption></figure>

## SSTI

> *The example below is based on OffSec's* [*WEB-200*](https://www.offsec.com/courses/web-200/) *course.*

We can leverage the [`Execute`](https://freemarker.apache.org/docs/api/freemarker/template/utility/Execute.html) class which implements the `TemplateModel` interface to achieve RCE in a FreeMarker templating engine.

```ftl
${"freemarker.template.utility.Execute"?new()("whoami")}
```
