hunt-ssti

Name: hunt-ssti
Availability: InStock
Author: ChatBotKit

Fingerprint SSTI vulnerabilities across template engines and test payloads for RCE paths.

13|2|Updated Jun 1, 2026

Search Tags:#web-security #payloads #rce #security-testing #ssti #template-injection

Ready to run

npx skills add https://github.com/chatbotkit/rook --skill hunt-ssti-chatbotkit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-ssti
Source: https://github.com/chatbotkit/rook/tree/main/skills/hunt-ssti
Command: npx skills add https://github.com/chatbotkit/rook --skill hunt-ssti-chatbotkit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Server-side template injection (SSTI) vulnerabilities allow attackers to run arbitrary code when web applications render user-supplied input through template engines. This skill provides detection patterns, engine fingerprinting guidance, and escalation pathways to post-exploitation steps.

Core Features & Use Cases

Detects SSTI payloads and fingerprints engines across Jinja2, Twig, Freemarker, ERB, Thymeleaf, Velocity, Mako, and Smarty.
Maps fingerprint results to engine-specific RCE pathways and documentation references.
Useful for web-app security testing to identify surfaces where user input is rendered and to verify potential chain to remote code execution.

Quick Start

Test a known endpoint with SSTI payloads to fingerprint the engine and verify possible RCE paths.

Frequently Asked Questions about hunt-ssti

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect server-side template injection vulnerabilities in web applications?▼

Server-side template injection (SSTI) is detected by injecting specific payloads into web application inputs to fingerprint the rendering engine and identify potential remote code execution paths across major template engines.

Can I use SSTI payloads to fingerprint specific template engines like Jinja2 or Twig?▼

Yes, SSTI payloads can fingerprint specific template engines including Jinja2, Twig, Freemarker, ERB, Thymeleaf, Velocity, Mako, and Smarty by analyzing how each engine evaluates injected syntax and responds to probing patterns.

What is the best way to escalate server-side template injection to remote code execution?▼

The best way to escalate SSTI to RCE is to map fingerprinted engine results to engine-specific class-walker patterns or related escalation pathways, verifying the chain within safe and auditable testing practices.

Does this SSTI detection approach work across multiple template engines?▼

Yes, this SSTI detection approach works across major template engines including Jinja2, Twig, Freemarker, ERB, Thymeleaf, Velocity, Mako, and Smarty, applying engine-specific payload testing to locate vulnerabilities and RCE risks.

How do I test an endpoint for SSTI vulnerabilities step by step?▼

Test an endpoint for SSTI by injecting template syntax payloads to fingerprint the engine, mapping results to engine-specific RCE pathways, and verifying potential remote code execution chains within safe and auditable testing practices.