ssti-freemarker

Identify Java template engines and generate SSTI payloads for RCE and file reading.

253|37|Updated Feb 22, 2026

Search Tags:#java #velocity #rce #ssti #spel #freemarker

Ready to run

npx skills add https://github.com/blacklanternsecurity/red-run --skill ssti-freemarker

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ssti-freemarker
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/ssti-freemarker
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill ssti-freemarker

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps penetration testers identify and exploit Server-Side Template Injection (SSTI) vulnerabilities in Java applications, specifically targeting engines like Freemarker, Velocity, and SpEL, to achieve code execution or file access.

Core Features & Use Cases

Engine Identification: Differentiates between various Java template engines (Freemarker, Velocity, Thymeleaf, Pebble, SpEL, Groovy) using error messages and syntax variations.
Remote Code Execution (RCE): Provides payloads for achieving RCE through direct class execution, file reading, and sandbox bypass techniques.
Use Case: When a web application displays user-generated content within a Freemarker template, this Skill can be used to inject malicious code that executes on the server, potentially leading to a full compromise.

Quick Start

Use the ssti-freemarker skill to attempt to execute the 'id' command on the target server.

Frequently Asked Questions about ssti-freemarker

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I exploit Server-Side Template Injection in Java applications?▼

Server-Side Template Injection in Java applications is exploited by injecting malicious template code to achieve Remote Code Execution or file reading. This Skill guides payload generation for engines like Freemarker, Velocity, Thymeleaf, Pebble, SpEL, Groovy, and Java EL.

How can I identify which Java template engine is running from error messages?▼

Java template engines are identified by analyzing specific error messages and syntax variations. This Skill differentiates between Freemarker, Velocity, Thymeleaf, Pebble, Spring Expression Language, Groovy, and Java EL to determine the correct exploitation path.

What payloads work for Freemarker RCE and sandbox bypass?▼

Freemarker RCE payloads involve direct class execution and sandbox bypass techniques to execute commands on the server. This Skill provides specific payloads for Remote Code Execution, file reading, and bypassing template sandbox restrictions.

Does this Skill include OPSEC considerations for Java process execution?▼

OPSEC considerations for Java process execution are included to maintain stealth during exploitation. The Skill provides operational security guidance tailored to the Java JVM and process execution behaviors when leveraging SpEL or Groovy injection.

Can I use Spring Expression Language injection to read server files?▼

Spring Expression Language injection can be used to read server files and achieve Remote Code Execution. This Skill provides specific SpEL payloads for file access and command execution within vulnerable Java applications.