Detect, fingerprint, and exploit Server-Side Template Injection vulnerabilities in web applications.
npx skills add https://github.com/Rifteo/skills --skill ssti-hunter
Please help me install this Agent Skill. Skill: ssti-hunter Source: https://github.com/Rifteo/skills/tree/main/ssti-hunter Command: npx skills add https://github.com/Rifteo/skills --skill ssti-hunter
The ssti-hunter Skill automates the detection and exploitation of Server-Side Template Injection (SSTI) vulnerabilities, ensuring thorough identification and handling of such security risks.
Run the 'ssti-hunter' Skill on the target application to automatically detect SSTI vulnerabilities.
High-intent search queries and answers about installing and using this skill.
To detect Server-Side Template Injection vulnerabilities, you can automate systematic detection and payload testing across web application inputs. This identifies vulnerable server-side template rendering points and verifies if injection is possible.
The best way to identify the template engine used in an SSTI attack is through engine fingerprinting. This process systematically tests payloads to determine the specific engine, such as Jinja2, Twig, or Smarty, handling the server-side rendering.
Yes, exploiting SSTI vulnerabilities to achieve Remote Code Execution requires Python libraries such as requests, bs4, pynacl, and requests-fuzz. These dependencies facilitate the systematic analysis and payload testing needed for successful exploitation.
Yes, you can obtain RCE payloads specifically for Jinja2, Twig, Smarty, and other template engines. The exploitation process provides tailored methods and payloads designed for the identified engine to successfully achieve Remote Code Execution.
SSTI exploitation targets web applications with vulnerable server-side template rendering. It focuses on identifying and exploiting injection points in supported engines like Jinja2 and Twig, rather than universally affecting all web applications.
se1111thAutomate language toolchain and system dependency installation via Nix.
cmndcntrlcyberDetect and exploit server-side template injection vulnerabilities across template engines.
AeonDaveFuzz HTTP endpoints with wordlists to discover directories, parameters, and virtual hosts.
utsavthakurDetect and exploit Server-Side Template Injection vulnerabilities in web applications.
