Fingerprint SSTI vulnerabilities across template engines and test payloads for RCE paths.
npx skills add https://github.com/chatbotkit/rook --skill hunt-ssti-chatbotkit
Please help me install this Agent Skill. Skill: hunt-ssti Source: https://github.com/chatbotkit/rook/tree/main/skills/hunt-ssti Command: npx skills add https://github.com/chatbotkit/rook --skill hunt-ssti-chatbotkit
Server-side template injection (SSTI) vulnerabilities allow attackers to run arbitrary code when web applications render user-supplied input through template engines. This skill provides detection patterns, engine fingerprinting guidance, and escalation pathways to post-exploitation steps.
Test a known endpoint with SSTI payloads to fingerprint the engine and verify possible RCE paths.
High-intent search queries and answers about installing and using this skill.
Server-side template injection (SSTI) is detected by injecting specific payloads into web application inputs to fingerprint the rendering engine and identify potential remote code execution paths across major template engines.
Yes, SSTI payloads can fingerprint specific template engines including Jinja2, Twig, Freemarker, ERB, Thymeleaf, Velocity, Mako, and Smarty by analyzing how each engine evaluates injected syntax and responds to probing patterns.
The best way to escalate SSTI to RCE is to map fingerprinted engine results to engine-specific class-walker patterns or related escalation pathways, verifying the chain within safe and auditable testing practices.
Yes, this SSTI detection approach works across major template engines including Jinja2, Twig, Freemarker, ERB, Thymeleaf, Velocity, Mako, and Smarty, applying engine-specific payload testing to locate vulnerabilities and RCE risks.
Test an endpoint for SSTI by injecting template syntax payloads to fingerprint the engine, mapping results to engine-specific RCE pathways, and verifying potential remote code execution chains within safe and auditable testing practices.
uphiagoDetect server-side template injection vulnerabilities and escalate to remote code execution.
pdparchitectIdentify and exploit server-side template injection vulnerabilities across Jinja2, Twig, and Freemarker.
giosuetedeschi-specIdentify and validate HTML injection vulnerabilities in web application inputs.
SnailSploitDetect and exploit Server-Side Template Injection vulnerabilities across web frameworks.
