skills.rest
cmndcntrlcyber
cmndcntrlcyberCOMMUNITY
Explore all skills by this author →
GitHub

hunt-ssti

Detect and exploit server-side template injection vulnerabilities across template engines.

3|Updated Nov 12, 2025
Search Tags:#red team#web application security#vulnerability scanning#RCE#SSTI
One-click install
npx skills add https://github.com/cmndcntrlcyber/rtpi --skill hunt-ssti-cmndcntrlcyber
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-ssti
Source: https://github.com/cmndcntrlcyber/rtpi/tree/main/knowledge_seed/bug_hunter_skills/hunt-ssti
Command: npx skills add https://github.com/cmndcntrlcyber/rtpi --skill hunt-ssti-cmndcntrlcyber

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill enables you to easily identify Server-Side Template Injection (SSTI) vulnerabilities across multiple server-side template engines, potentially leading to Remote Code Execution (RCE).

Core Features & Use Cases

  • SSTI Detection: Identifies SSTI across popular template engines (e.g., Jinja2, Twig, Freemarker).
  • Engine-specific Exploits: Provides engine-specific payloads to exploit identified SSTIs, potentially leading to RCE.
  • Quick Scan and Assessment: Scan target systems or services quickly and assess the potential severity of identified SSTI vulnerabilities.
  • Use Case: Ideal for red teamers and security auditors who need to quickly uncover vulnerabilities that can be leveraged to achieve RCE on targeted systems.

Quick Start

Use the 'hunt-ssti' skill to scan the application for SSTI vulnerabilities and exploit them for Remote Code Execution.

Frequently Asked Questions about hunt-ssti

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect server-side template injection vulnerabilities in web applications?▼

You can identify server-side template injection vulnerabilities by scanning target web applications to detect SSTI across popular template engines like Jinja2, Twig, and Freemarker using engine-specific payloads for quick assessment.

Can SSTI vulnerabilities lead to remote code execution on target systems?▼

Yes, SSTI vulnerabilities can lead to remote code execution. This Skill provides engine-specific exploits designed to leverage identified server-side template injections, aiming to uncover and achieve RCE opportunities on the targeted systems.

What is the best way to exploit Jinja2 or Twig template engines during a red team engagement?▼

The best way to exploit Jinja2 or Twig during a red team engagement is using engine-specific payloads that quickly identify SSTI vulnerabilities and attempt remote code execution across common server-side template frameworks.

Does server-side template injection scanning require specific environment permissions?▼

Yes, server-side template injection scanning requires an environment with web access to the target systems and appropriate permissions for payload execution to properly detect SSTI and attempt remote code execution.

What template engines are supported for SSTI vulnerability detection?▼

Supported template engines for SSTI vulnerability detection include common server-side frameworks like Jinja2, Twig, and Freemarker, with engine-specific payloads provided to accurately identify and exploit template injection vulnerabilities.

Related Skills

AeonDaveAeonDave
15

tplmap

Automate SSTI detection and exploitation across template engines like Jinja2, Twig, and Smarty.

Community
Advanced
cybersecwomancybersecwoman
5

hunt-rce

Automate identification of Remote Code Execution vulnerabilities across various targets.

Community
Advanced
SnailSploitSnailSploit
2.9k

rce

Identify and exploit Remote Code Execution vulnerabilities across web applications and infrastructure.

Community
Advanced
yhy0yhy0
518

ssrf

Detect and exploit server-side request forgery vulnerabilities in URL parameters.

Community
Advanced