hunt-ssti

Send arithmetic probes like {{7*7}}, ${7*7}, <%= 7*7 %>, and *{7*7} to every input reflected in rendered output. A response of 49 confirms server-side evaluation; the probe syntax that evaluates identifies which template engine is in use.

Send {{7*'7'}}: Jinja2 performs Python string repetition and returns 7777777, while Twig coerces the string numerically and returns 49. This single payload differentiates the two engines before selecting an RCE payload.

Traditional form endpoints read application/x-www-form-urlencoded bodies, so JSON payloads are silently ignored by handlers like request.form['field']. Resend the payload as a form-encoded body field instead of JSON.

No, arithmetic evaluation only confirms injection, not impact. Sandboxed engines like Twig sandbox mode or Jinja2 SandboxedEnvironment may block runtime access, so you must prove command execution with id output or an out-of-band callback before claiming Critical severity.

Fingerprint the engine first since editors often run Freemarker, keep the record ID in the query string rather than the body, re-fetch a fresh CSRF token each request, and iterate with template-action=preview before saving the final payload.

Sandboxed SSTI without runtime escape is typically Medium severity, but the same reflection often yields stored XSS in rendered emails or SSRF through URL-fetching filters like Twig's include() targeting cloud metadata endpoints.