DOJO Challenge #28 Winners!

This write-up details exploitation of a server-side template injection (SSTI) in Apache Velocity, showing a working proof-of-concept that leverages Velocity's ClassTool and Runtime.exec to run system commands (demonstrated with `whoami` returning root). It also describes filter-evasion techniques (Quiet Reference Notation and bracketed directives), discusses the risk of full server compromise and lateral movement, and provides remediation guidance such as avoiding user-editable templates, using logic-less engines, input sanitization, and sandboxing.