What problem does it solve? Server-side template injection is easy to miss and often under-reported: arithmetic probes can fail silently, the wrong engine syntax wastes time, and testers stop at detection instead of proving RCE impact. This Skill provides a structured methodology to fingerprint the template engine, escalate to remote code execution, and avoid common false negatives during bug bounty hunting. ## Core Features & Use Cases - Engine Fingerprinting Matrix: Differentiate Jinja2, Twig, Freemarker, Velocity, ERB, Thymeleaf, and Mako using math-expression probes like {{77}}, ${77}, and {{7*'7'}}. - RCE Escalation Payloads: Engine-specific exploitation patterns including the Jinja2 class-walker via config.class.init.globals, Twig registerUndefinedFilterCallback, and the Freemarker Execute utility. - Edge-Case Handling: Guidance for length-constrained fields, authenticated CMS template editors with CSRF tokens and preview actions, form-encoded vs JSON body pitfalls, and email-based reflected sinks. - Use Case: While testing a target's profile-name field, you confirm Jinja2 injection with a short probe, enumerate the subclass index in stages to fit the length limit, and read the command output from the outbound confirmation email to prove RCE for a report. ## Quick Start Test the target's name field for SSTI by sending {{7*7}} and escalating to the Jinja2 os.popen payload if it evaluates to 49.
