skills.rest
Carlos-Reyes-UTP
Carlos-Reyes-UTPCOMMUNITY
Explore all skills by this author →
GitHub

hunt-ssti

Detect server-side template injection via engine-specific reflection probes.

2|Updated Apr 11, 2025
Search Tags:#jinja2#twig#web security testing#ssti#template injection#rce detection
One-click install
npx skills add https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda --skill hunt-ssti
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-ssti
Source: https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda/tree/main/.agent/skills/hunt-ssti
Command: npx skills add https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda --skill hunt-ssti

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you quickly identify Server-Side Template Injection (SSTI) vulnerabilities and determine whether the template rendering path can be escalated toward remote code execution.

Core Features & Use Cases

  • Fingerprint the template engine: Uses math-expression reflection probes (e.g., double-curly and dollar-curly variants) to distinguish Jinja2, Twig, Freemarker, ERB, Spring/Thymeleaf, Mako, and Smarty.
  • Escalate to engine-specific execution: After confirming the engine, applies targeted class-walker, callback/utility, or execution-pattern payloads aligned to disclosed techniques for that engine family.
  • Guide where SSTI commonly appears: Focuses on email templates, PDF/report generators, CMS preview or error pages, and other areas where user-controlled strings are composed and rendered by a server-side engine.

Quick Start

Ask the AI to run SSTI detection by testing reflection with {{77}}, ${77}, and engine-matching probes, then escalate using the correct engine-specific RCE payload once the engine is fingerprinted.

Frequently Asked Questions about hunt-ssti

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect server-side template injection vulnerabilities in web applications?▼

Detect server-side template injection by probing rendered output with deterministic reflection probes like {{7*7}} or ${7*7} to identify if user-controlled strings are evaluated by the template engine.

What is the best way to test for SSTI in email templates and PDF generators?▼

The best way to test for SSTI in email templates and PDF generators is to submit math-expression probes into user-controlled inputs that flow into server-side rendering paths and check if the output reflects evaluated expressions.

How do I fingerprint template engines like Jinja2 or Twig during SSTI testing?▼

Fingerprint template engines by sending engine-specific reflection probes such as double-curly and dollar-curly variants to distinguish between Jinja2, Twig, Freemarker, ERB, Spring, Mako, and Smarty based on output characteristics.

Can I validate remote code execution paths after confirming an SSTI vulnerability?▼

You can validate remote code execution paths by applying engine-specific escalation payloads, using targeted class-walker, callback utility, or execution-pattern techniques aligned to the fingerprinted template engine family.

What inputs should I target when testing for SSTI in a web application?▼

Target inputs flowing into template rendering such as error pages, email templates, report or PDF generators, and CMS preview features that reflect or interpret user strings server-side to identify SSTI exposure.

Related Skills

Explore More Software Engineering Skills→
ok-helloworldok-helloworld
241

expression-language-injection

Detect and validate expression language injection in Java EL evaluators.

Community
Advanced
yhy0yhy0
74

pentest-deserialization-xxe

Identify and exploit deserialization and XXE vulnerabilities in web applications.

Community
Advanced
jokken79jokken79
1

Burp Suite Web Application Testing

Intercept, modify, and analyze HTTP traffic to identify web application vulnerabilities.

Community
Advanced
AcczdyAcczdy
2

performing-web-application-penetration-test

Automate web application penetration testing following the OWASP WSTG with Burp Suite.

Community
Advanced