hunt-ssti

Server-side template injection (SSTI) vulnerabilities are detected by injecting template syntax into user input fields and observing server-rendered responses. This Skill provides detection payloads to fingerprint template engines like Jinja2, Twig, and Freemarker, confirming if user input is rendered server-side.

The best way to fingerprint template engines during pentest is using engine-specific syntax probes. This Skill applies detection payloads targeting Jinja2, Twig, Freemarker, ERB, Thymeleaf, Velocity, Mako, and Smarty to identify the active engine from rendered responses.

SSTI escalates to remote code execution (RCE) through engine-specific class-walker or execute patterns. This Skill provides RCE payloads and escalation patterns to validate exploitability in controlled assessments.

Yes, this SSTI testing approach works for bug bounty and red-team engagements. The Skill provides practical testing surfaces and test plan guidance specifically designed for these scenarios, including safe validation and documented results.

The template engines covered for SSTI detection include Jinja2, Twig, Freemarker, ERB, Thymeleaf, Velocity, Mako, and Smarty. The Skill maps vulnerabilities across these common engines for server-rendered applications and components.

SSTI payload testing requires knowledge of engine fingerprints because template syntax varies significantly across engines. Identifying the specific engine allows targeted use of class-walker or execute patterns for successful RCE escalation.