skills.rest
cybersecwoman
cybersecwomanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-ssti

Detect server-side template injection vulnerabilities across multiple template engines.

5|Updated May 27, 2026
Search Tags:#vulnerability detection#template engine#security assessment#ssti#remote code execution
One-click install
npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill hunt-ssti-cybersecwoman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-ssti
Source: https://github.com/cybersecwoman/Kiro-BugHunter/tree/main/skills/hunt-ssti
Command: npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill hunt-ssti-cybersecwoman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill identifies server-side template injection vulnerabilities, allowing for the detection of SSTI across various template engines.

Core Features & Use Cases

  • SSTI Detection: Automatically detects SSTI across multiple template engines such as Jinja2, Twig, Freemarker, ERB, Spring, Velocity, Mako, Thymeleaf, and Smarty.
  • RCE Escalation: Escalates from SSTI to remote code execution (RCE) via engine-specific patterns.
  • Target Identification: Identifies common targets such as email templates, PDF generators, CMS preview features, and error pages with user input.

Quick Start

Run the skill with the target domain to initiate the SSTI scan.

Frequently Asked Questions about hunt-ssti

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect server-side template injection vulnerabilities in web applications?▼

Server-side template injection detection works by injecting specific payloads into common targets like email templates and CMS preview features, then identifying which template engine processes the input to evaluate and confirm the vulnerability.

What template engines are vulnerable to SSTI and remote code execution?▼

Vulnerable template engines include Jinja2, Twig, Freemarker, ERB, Spring, Velocity, Mako, Thymeleaf, and Smarty. SSTI detection identifies the active engine and uses engine-specific patterns to escalate to remote code execution.

Can I escalate server-side template injection to remote code execution?▼

Yes, you can escalate SSTI to remote code execution. The detection process uses engine-specific patterns and payloads tailored to the identified template engine to successfully trigger and execute remote commands.

Where are the most common targets for SSTI attacks?▼

Common targets for SSTI attacks include email templates, PDF generators, CMS preview features, and error pages that directly incorporate user input into server-side template rendering processes.

How do I run an SSTI scan on a target domain?▼

To run an SSTI scan, initiate the skill by providing the target domain. The script will then automatically scan for template injection vulnerabilities and attempt engine detection across the application.

Related Skills

Explore More Software Engineering Skills→
ricardoo022ricardoo022

scan-fase-1

Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.

Community
Advanced
kolife01kolife01

evi-secret-guard

Block access to secret files and destructive commands in Claude Code.

Community
Advanced
aussierobotsaussierobots
2

middleware-patterns

Implement MCP middleware patterns for HTTP and Lambda transports.

Official
Advanced
bpnrockstarbpnrockstar

hunt-ssti

Detect server-side template injection vulnerabilities and escalate to remote code execution.

Community
Advanced