ssti-detect

Detect Server-Side Template Injection vulnerabilities in web applications.

Updated May 16, 2026

Search Tags:#penetration testing #web application security #ssti #template injection #remote code execution

Ready to run

npx skills add https://github.com/Chid0k/claude-marketplace --skill ssti-detect

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ssti-detect
Source: https://github.com/Chid0k/claude-marketplace/tree/main/plugins/vuln-detect-plugin/skills/ssti-detect
Command: npx skills add https://github.com/Chid0k/claude-marketplace --skill ssti-detect

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires burp, burp Collaborator, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill helps in detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities in web applications, enabling penetration testers and bug bounty hunters to uncover potential security flaws.

Core Features & Use Cases

SSTI Detection: Identifies user input embedded in templates that can lead to remote code execution.
Template Engine Identification: Determines the specific template engine used in the application.
Exploitation Techniques: Provides methodologies to exploit identified SSTI vulnerabilities for remote code execution.
Use Case: A pentester uses this Skill on a web application to detect SSTI vulnerabilities in its template engines, such as Jinja2, Twig, and others, and to attempt to exploit them for code execution.

Quick Start

Use the ssti-detect skill to detect SSTI vulnerabilities in the provided web application.

Frequently Asked Questions about ssti-detect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is Server-Side Template Injection and how does it lead to remote code execution?▼

Server-Side Template Injection (SSTI) occurs when user input is embedded directly into template engines, allowing attackers to execute arbitrary code. This Skill identifies SSTI vulnerabilities and determines the specific template engine to help uncover potential remote code execution flaws during web application security audits.

How do I detect template injection vulnerabilities in web applications?▼

To detect template injection vulnerabilities, this Skill analyzes web application inputs to identify user data embedded in templates. It identifies the active template engine, such as Jinja2 or Twig, and provides methodologies to exploit these points for remote code execution during penetration testing.

Do I need Burp Collaborator to test for SSTI vulnerabilities?▼

Yes, you need both Burp and Burp Collaborator to use this Skill. It relies on the Burp MCP and Collaborator to identify template engines, detect SSTI vulnerabilities, and verify potential exploitation points within the target web application.

How do I identify which template engine a web application is using?▼

This Skill identifies the specific template engine used by a web application by analyzing its responses to injected template syntax. Recognizing engines like Jinja2 or Twig is a prerequisite step for applying the correct exploitation techniques to achieve remote code execution.

What is the best way to exploit SSTI for remote code execution during a penetration test?▼

The best way to exploit SSTI for remote code execution is to first identify the template engine, then apply engine-specific payloads. This Skill provides exploitation methodologies tailored to the detected template engine to verify code execution during security audits.

Can I use this Skill for bug bounty hunting and web application security audits?▼

Yes, this Skill is designed for penetration testers and bug bounty hunters conducting web application security audits. It detects SSTI vulnerabilities, identifies template engines, and attempts exploitation for remote code execution to uncover security flaws.