ssti

Name: ssti
Availability: InStock
Author: SecurityforTech

Detect and exploit Server-Side Template Injection vulnerabilities in web applications.

6|1|Updated Mar 9, 2026

Search Tags:#penetration testing #web security #vulnerability detection #rce #ssti #template injection

Ready to run

npx skills add https://github.com/securityfortech/hacking-skills --skill ssti-securityfortech

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ssti
Source: https://github.com/securityfortech/hacking-skills/tree/main/skills/web/injection/ssti
Command: npx skills add https://github.com/securityfortech/hacking-skills --skill ssti-securityfortech

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, tplmap, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and exploits Server-Side Template Injection (SSTI) vulnerabilities, which can lead to remote code execution on the server.

Core Features & Use Cases

SSTI Detection: Probes for template engine evaluation using mathematical expressions and specific syntaxes.
Template Engine Identification: Determines the specific server-side template engine in use (e.g., Jinja2, Twig, Freemarker).
Exploitation: Leverages engine-specific payloads to achieve RCE, file read, or other sensitive actions.
Use Case: A penetration tester uses this skill to find and exploit an SSTI vulnerability in a web application, gaining shell access to the server.

Quick Start

Use the ssti skill to test the target URL 'http://example.com/page?name=*' for Server-Side Template Injection.

Frequently Asked Questions about ssti

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect server-side template injection vulnerabilities in web applications?▼

To detect server-side template injection, probe target URLs by injecting mathematical expressions and specific syntaxes to analyze HTTP responses for evaluated template expressions or error messages indicating vulnerable engines.

What is the best way to identify the specific template engine during SSTI exploitation?▼

Identifying the specific template engine during SSTI exploitation involves analyzing server responses to specific syntax probes to determine whether Jinja2, Twig, or Freemarker is evaluating the injected template expressions.

How can I achieve remote code execution through server-side template injection?▼

You can achieve remote code execution through server-side template injection by leveraging engine-specific payloads that utilize sandbox escape and object traversal techniques to execute arbitrary commands on the target server.

Does tplmap work for automating server-side template injection detection and exploitation?▼

Tplmap works for automating server-side template injection detection and exploitation by running alongside curl to probe target URLs, identify template engines, and deploy payloads for remote code execution.

When do I need to test for template injection vulnerabilities?▼

You need to test for template injection vulnerabilities during web application penetration testing when user input is reflected or evaluated on the server, potentially leading to unauthorized remote code execution or sensitive file reads.