ssti-error-based-detection

Blind server-side template injection (SSTI) can be detected by analyzing differential error messages. This approach uses specialized polyglot payloads to trigger distinct errors, confirming if input is processed by a template engine without needing reflected output.

Identify the template engine in a blind SSTI by matching distinct error class names and stack trace details. This fingerprinting technique applies to common engines including Jinja2, Twig, Freemarker, ERB, and Velocity after triggering errors with polyglot payloads.

Error-based fingerprinting is the best way to test for SSTI when time-based detection is unreliable. It enables rapid engine identification by analyzing differential error messages triggered by polyglot payloads, streamlining subsequent authorized exploitation steps.

Error message fingerprinting for web application penetration testing currently targets specific engines. It successfully identifies Jinja2, Twig, Freemarker, ERB, and Velocity by triggering and analyzing their unique error class names and stack traces.

Standard SSTI detection fails without reflected output because it relies on visible template evaluation responses. Error-based detection overcomes this by sending polyglot payloads that trigger template engine errors, successfully identifying the underlying engine via error differentials.