We were able to login and edit product descriptions , And we were able to edit the template of it :
We replaced product.stock with 7*7 and was received with the following error :
We were able to see that this uses Django templating Engine after reading the error . We searched Hacktricks but was not able to find any information about Django. We found this page from cobalt.io and was able to see the following payloads :
First we used the {%debug%} and was able to see the following output and was able to see that we could use the settings object :
We were then able to use the payload {{settings.SECRET_KEY}} and see the secret_key. We submit the key and solved the lab :
