hunt-ssti

Server-Side Template Injection is detected by probing template rendering behavior with safe numeric payloads like {{7*7}} and inferring the active engine from the reflected evaluation output.

SSTI fingerprinting can identify engines such as Jinja2, Twig, Freemarker, Velocity, ERB, and Spring Thymeleaf by analyzing how they reflect specific probing payloads.

After engine fingerprinting, apply engine-specific escalation patterns such as class-walker, callback-registrar, or Execute utility patterns to validate potential remote code execution paths.

Common SSTI surfaces include template-rendered email bodies, CMS preview features, PDF and report generators, and reflected error pages that compose strings from user input before rendering.

Expression reflection probes use safe numeric payloads like {{7*7}} or ${7*7} to infer the active template engine without executing harmful commands, making them suitable for initial detection.

If template injection payloads render as plain text, the endpoint may not interpolate user input into server-rendered templates, or a different template engine syntax is required for that specific framework.