hunt-ssti

Detect server-side template injection vulnerabilities across multiple template engines.

Updated Jun 18, 2026

Search Tags:#web security #vulnerability detection #remote code execution #template engines #SSTI

Ready to run

npx skills add https://github.com/Kisilev13/Hermes-Agent-Workspace --skill hunt-ssti-kisilev13

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-ssti
Source: https://github.com/Kisilev13/Hermes-Agent-Workspace/tree/main/skills/hunt-ssti
Command: npx skills add https://github.com/Kisilev13/Hermes-Agent-Workspace --skill hunt-ssti-kisilev13

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill identifies server-side template injection (SSTI) vulnerabilities across various web templates and allows for potential remote code execution (RCE) exploitation.

Core Features & Use Cases

Detect SSTI: Identify SSTI vulnerabilities in Jinja2, Twig, Freemarker, ERB, Spring, Velocity, Mako, Thymeleaf, and Smarty templates.
Escalate to RCE: Ascertain if the SSTI can be leveraged for remote code execution.
Targeted Scanning: Scan for SSTI in specific targets such as email templates, PDF generators, CMS preview features, and error pages with user input.
Use Case: For security auditors and bug bounty hunters, it helps in quickly identifying potential RCE vectors in web applications.

Quick Start

Scan for SSTI in the 'index.html' file using the 'hunt-ssti' skill.

Frequently Asked Questions about hunt-ssti

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect server-side template injection vulnerabilities in web applications?▼

To detect server-side template injection (SSTI), scan web application inputs like email templates, PDF generators, and error pages for specific patterns. This process identifies SSTI vulnerabilities across template engines and checks for potential remote code execution vectors.

What is server-side template injection and how does it lead to remote code execution?▼

Server-side template injection (SSTI) is a vulnerability where user input is unsafely embedded into template engines. Exploiting SSTI can lead to remote code execution (RCE) by allowing attackers to execute arbitrary commands through the template engine's functionality.

Does SSTI detection work with Jinja2, Twig, and Freemarker template engines?▼

Yes, SSTI detection works with Jinja2, Twig, Freemarker, ERB, Spring, Velocity, Mako, Thymeleaf, and Smarty templates. The scanner identifies specific patterns indicative of SSTI across these various template engines during security auditing.

How do I scan for SSTI vulnerabilities in specific targets like CMS preview features?▼

Scan for SSTI vulnerabilities in specific targets by providing the web application endpoint or file to the scanner. It checks CMS preview features, PDF generators, email templates, and error pages with user input for remote code execution vectors.

What is the best way to escalate server-side template injection to remote code execution?▼

The best way to escalate server-side template injection (SSTI) to remote code execution is by identifying template engine-specific payloads. Security auditors ascertain if the SSTI can be leveraged for RCE by testing injection patterns against the target template engine.