ssti

Detect server-side template injection vulnerabilities across multiple web frameworks.

7|1|Updated Apr 14, 2026

Search Tags:#code execution #web security #vulnerability detection #ssti #template injection

Ready to run

npx skills add https://github.com/ArianHobson333/claude-bug-bounty-stack --skill ssti-arianhobson333

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ssti
Source: https://github.com/ArianHobson333/claude-bug-bounty-stack/tree/main/vendor/Decepticon/skills/analyst/ssti
Command: npx skills add https://github.com/ArianHobson333/claude-bug-bounty-stack --skill ssti-arianhobson333

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps identify and validate server-side template injection vulnerabilities across various web frameworks, ensuring secure web applications.

Core Features & Use Cases

Framework Support: Detects template injection across Jinja2, Twig, Freemarker, Velocity, and Handlebars.
Expression Evaluation: Identifies and enumerates available objects and filters within the framework.
File Read/Env Leak: Attempts file read and environment variable leakage to escalate the vulnerability.
Command Execution: Executes commands using framework-specific gadgets for code execution.
Validation: Validates findings using validate_finding for positive execution signals and benign negative controls.
Use Case: When conducting a web application security audit, use this Skill to automatically scan for and verify potential SSTI vulnerabilities in web applications.

Quick Start

Use the ssti skill to scan the 'example.com' domain for server-side template injection vulnerabilities.

Frequently Asked Questions about ssti

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect server-side template injection vulnerabilities in web frameworks?▼

Server-side template injection detection works by checking for template rendering with user input, confirming user-controlled payloads in template contexts, and validating execution signals using framework-specific gadgets across Jinja2, Twig, Freemarker, Velocity, and Handlebars.

What is the best way to validate SSTI execution signals without false positives?▼

Validating SSTI execution signals requires checking positive execution signals alongside benign negative controls. This validation process confirms that detected template rendering with user input represents a true vulnerability rather than a benign framework behavior.

Does SSTI detection work with Jinja2 and Twig template frameworks?▼

SSTI detection works with Jinja2 and Twig template frameworks. It also supports Freemarker, Velocity, and Handlebars by analyzing framework-specific template contexts and enumerating available objects and filters to identify code execution gadgets.

How to enumerate available objects and filters during template injection testing?▼

Enumerating available objects and filters during template injection testing involves evaluating expressions within the target framework's template context. This expression evaluation identifies accessible variables and functions that can be leveraged for file read, env leak, or command execution gadgets.

Can I use template injection to execute commands and leak environment variables?▼

Template injection can be used to execute commands and leak environment variables. The technique uses framework-specific gadgets for code execution, attempting file read and environment variable leakage to escalate the vulnerability after confirming user-controlled payload injection.

When do I need framework-specific gadgets for SSTI code execution?▼

Framework-specific gadgets for SSTI code execution are needed when template rendering with user input is confirmed. Different frameworks like Jinja2, Twig, Freemarker, Velocity, and Handlebars require distinct gadgets to escalate from expression evaluation to actual command execution.