Research on SSTI attack defense technology based on instruction set randomization

With the rapid development of the Internet industry, and because scripting languages such as Python, PHP, Ruby have the characteristics of rapid development and easy learning, they are often used in the development process of application programs. Template engine technology can realize the separation of front and back ends in the development process., So it is often used in the development process, but if the developer does not perform strict filtering during the development process of the template engine, the attacker can use the vulnerability to launch a server-side template injection attack (Server-Side-Template-Injection, SSTI), and the current defense methods are too passive because they rely on the detection rate and the prior knowledge of the attacker, so a SSTI defense technology based on randomization technology is proposed.