Detect server-side template injection vulnerabilities and escalate to remote code execution.
npx skills add https://github.com/uphiago/recon-skills --skill hunt-ssti-uphiago
Please help me install this Agent Skill. Skill: hunt-ssti Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-ssti Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-ssti-uphiago
Server-side template injection (SSTI) is a high-severity vulnerability that can lead to unauthenticated remote code execution, but manual detection across multiple template engines is time-consuming and error-prone. This Skill automates the full SSTI hunting workflow from detection to RCE escalation for all major template engines.
Use the hunt-ssti skill to test all user-controlled input fields on the target web application for server-side template injection vulnerabilities and escalate any confirmed findings to remote code execution.
High-intent search queries and answers about installing and using this skill.
Server-side template injection vulnerabilities are detected by injecting polyglot differential math expression probes to fingerprint specific engines like Jinja2, Twig, and Freemarker, then applying engine-specific payloads to confirm remote code execution paths.
The best way to escalate SSTI to remote code execution is by applying engine-specific RCE payloads tailored to the identified template engine, including bypass techniques for WAFs, sandboxes, and character filters to achieve full server compromise.
Yes, you can test CMS page builders, email template systems, and PDF generators for SSTI flaws by mapping common injection sink patterns and injecting user-controlled input into server-side template rendering features.
Blind SSTI out-of-band detection methods work by injecting template payloads that trigger external network interactions, allowing you to confirm code execution on vulnerable API endpoints or error pages without visible application responses.
Yes, this SSTI vulnerability hunting approach works with Java template engines like Thymeleaf and Velocity, alongside ERB and Smarty, using multi-engine fingerprinting logic to identify and exploit server-side rendering flaws.
langbyyiIdentify GraphQL API vulnerabilities including hidden parameters and authorization gaps.
jcastillotxEnumerate Linux systems for privilege escalation paths to root.
utsavthakurDetect and exploit Server-Side Template Injection vulnerabilities in web applications.
dreadnodeDetect blind SSTI vulnerabilities by analyzing differential error messages.
