Detect and exploit server-side template injection vulnerabilities to achieve remote code execution.
npx skills add https://github.com/zebbern/termstack --skill ssti-poc
Please help me install this Agent Skill. Skill: ssti-poc Source: https://github.com/zebbern/termstack/tree/main/.github/skills/ssti-poc Command: npx skills add https://github.com/zebbern/termstack --skill ssti-poc
SSTI-POC helps security researchers identify and validate server-side template injection vulnerabilities to confirm remote code execution paths in real-world templates.
Run SSTI-POC in a secure lab against a test URL to validate SSTI vulnerabilities and demonstrate possible RCE.
High-intent search queries and answers about installing and using this skill.
Server-side template injection vulnerabilities are detected and exploited by injecting payloads into user-supplied templates rendered by engines like Jinja2, Twig, or Freemarker. This Skill provides an end-to-end workflow covering detection, interactive exploration, payload delivery, and remote code execution validation.
Yes, remote code execution can be verified across multiple template engines including Jinja2, Twig, Freemarker, ERB, Nunjucks, Velocity, Pug, and Smarty. It applies SSTImap-based workflows to deliver exploit payloads and achieve OS-shell or file-read capabilities for validation.
The best way to scan for SSTI vulnerabilities is using guided scenarios that reference tools like SSTImap, tplmap, and TInjA. These tools enable efficient detection, interactive exploration, and exploitation workflows to validate template injection risks in web applications.
Yes, modern and legacy template injection scanning are supported. It references SSTImap and TInjA for efficient current SSTI detection, while including tplmap references for validating historical templates to ensure comprehensive coverage across different template engines.
SSTI risks are validated safely by running detection and exploitation workflows in a secure lab against a test URL. This approach allows you to verify remote code execution paths, demonstrate possible exploits, and document template injection risks without impacting production systems.
Server-side template injection leads to remote code execution when web applications render user-supplied templates using engines like Jinja2 or Smarty. Attackers can inject malicious payloads that the engine executes, enabling OS-shell access or file-read capabilities through the template rendering process.
cmndcntrlcyberDetect and exploit server-side template injection vulnerabilities across template engines.
yhy0Identifies and exploits command injection and remote code execution vulnerabilities in web applications.
transilienceaiCoordinate subdomain discovery and port scanning to build a domain attack surface inventory.
AeonDaveAutomate SSTI detection and exploitation across template engines like Jinja2, Twig, and Smarty.
