ssti-detect

Server-Side Template Injection (SSTI) occurs when user input is embedded directly into template engines, allowing attackers to execute arbitrary code. This Skill identifies SSTI vulnerabilities and determines the specific template engine to help uncover potential remote code execution flaws during web application security audits.

To detect template injection vulnerabilities, this Skill analyzes web application inputs to identify user data embedded in templates. It identifies the active template engine, such as Jinja2 or Twig, and provides methodologies to exploit these points for remote code execution during penetration testing.

Yes, you need both Burp and Burp Collaborator to use this Skill. It relies on the Burp MCP and Collaborator to identify template engines, detect SSTI vulnerabilities, and verify potential exploitation points within the target web application.

This Skill identifies the specific template engine used by a web application by analyzing its responses to injected template syntax. Recognizing engines like Jinja2 or Twig is a prerequisite step for applying the correct exploitation techniques to achieve remote code execution.

The best way to exploit SSTI for remote code execution is to first identify the template engine, then apply engine-specific payloads. This Skill provides exploitation methodologies tailored to the detected template engine to verify code execution during security audits.

Yes, this Skill is designed for penetration testers and bug bounty hunters conducting web application security audits. It detects SSTI vulnerabilities, identifies template engines, and attempts exploitation for remote code execution to uncover security flaws.