skills.rest
Skobyn
SkobynCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-ssti

Detect server-side template injection vulnerabilities and escalate to remote code execution.

Updated Jun 24, 2026
Search Tags:#vulnerability detection#web application security#template engine#ssti#remote code execution
One-click install
npx skills add https://github.com/Skobyn/talon --skill hunt-ssti-skobyn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-ssti
Source: https://github.com/Skobyn/talon/tree/main/skills/hunt-ssti
Command: npx skills add https://github.com/Skobyn/talon --skill hunt-ssti-skobyn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and demonstrates exploitation of server-side template injection (SSTI) vulnerabilities across various template engines, providing a direct path to remote code execution (RCE).

Core Features & Use Cases

  • Engine Detection: Identifies and fingerprints template engines like Jinja2, Twig, Freemarker, ERB, Spring, Velocity, Mako, Thymeleaf, and Smarty.
  • RCE Escalation: Escalates from detection to RCE using engine-specific patterns documented in disclosed reports.
  • Target Identification: Tests email templates, PDF generators, CMS preview features, and error pages for SSTI vulnerabilities.
  • Use Case: When hunting for RCE vulnerabilities in web applications, this Skill can help identify and exploit SSTI flaws leading to RCE.

Quick Start

Use the hunt-ssti skill to scan the 'acme.com' application for server-side template injection vulnerabilities.

Frequently Asked Questions about hunt-ssti

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect server-side template injection vulnerabilities in a web application?▼

Detect server-side template injection vulnerabilities by identifying and fingerprinting template engines like Jinja2, Twig, Freemarker, ERB, Spring, Velocity, Mako, Thymeleaf, and Smarty using specific payloads. Test email templates, PDF generators, and CMS preview features for injection points.

Can I escalate server-side template injection to remote code execution?▼

Yes, server-side template injection can be escalated to remote code execution. Use engine-specific patterns and payloads documented in disclosed reports to move from detection to RCE across various template engines.

What parts of a web application are most vulnerable to SSTI?▼

Email templates, PDF generators, CMS preview features, and error pages are the most vulnerable to SSTI. These components often process user-controlled input directly through template engines, creating injection points.

How do I fingerprint which template engine is running before exploiting SSTI?▼

Fingerprint template engines by injecting specific payloads designed to trigger unique responses from Jinja2, Twig, Freemarker, ERB, Spring, Velocity, Mako, Thymeleaf, or Smarty. Analyzing the application's response identifies the underlying engine.

What's the best way to test for SSTI across multiple template engines?▼

The best way to test for SSTI across multiple template engines is to use engine-specific payloads that fingerprint the engine and escalate to remote code execution, targeting areas like email templates and PDF generators where user input reaches templates.

Related Skills

Explore More Software Engineering Skills→
uphiagouphiago
1.1k

hunt-ssti

Detect server-side template injection vulnerabilities and escalate to remote code execution.

Community
Advanced
jcastillotxjcastillotx

Linux Privilege Escalation

Enumerate Linux systems for privilege escalation paths to root.

Community
Advanced
jokken79jokken79
1

Burp Suite Web Application Testing

Intercept, modify, and analyze HTTP traffic to identify web application vulnerabilities.

Community
Advanced
RifteoRifteo
30

ssti-hunter

Detect, fingerprint, and exploit Server-Side Template Injection vulnerabilities in web applications.

Official
Advanced