hunt-ssti

What problem does it solve?

It helps you quickly identify Server-Side Template Injection (SSTI) vulnerabilities and determine whether the template rendering path can be escalated toward remote code execution.

Core Features & Use Cases

• Fingerprint the template engine: Uses math-expression reflection probes (e.g., double-curly and dollar-curly variants) to distinguish Jinja2, Twig, Freemarker, ERB, Spring/Thymeleaf, Mako, and Smarty.
• Escalate to engine-specific execution: After confirming the engine, applies targeted class-walker, callback/utility, or execution-pattern payloads aligned to disclosed techniques for that engine family.
• Guide where SSTI commonly appears: Focuses on email templates, PDF/report generators, CMS preview or error pages, and other areas where user-controlled strings are composed and rendered by a server-side engine.

Quick Start

Ask the AI to run SSTI detection by testing reflection with {{77}}, ${77}, and engine-matching probes, then escalate using the correct engine-specific RCE payload once the engine is fingerprinted.