ssti-server-side-template-injection

Server-side template injection is detected using polyglot probes, math evaluation, and error signatures to determine whether attacker-controlled inputs are evaluated by template engines, identifying the specific framework for targeted exploitation.

Fingerprinting a template engine during SSTI testing involves applying polyglot probes and analyzing error signatures to differentiate frameworks like Jinja2, Twig, FreeMarker, and Thymeleaf, separating true SSTI from XSS or expression language evaluation.

Blind SSTI can be confirmed using timing-based techniques, boolean checks, and out-of-band verification methods like DNS and HTTP callbacks to validate server-side evaluation when template output is not reflected back to the user.

Yes, this approach supports engine-specific payload strategies including sandbox-bypass patterns like MRO traversal for Jinja2, applying RCE-oriented and disclosure-oriented chains per template engine family.

Yes, polyglot probes using math and parsing checks can differentiate server-side template injection from XSS and expression language issues across multiple frameworks and languages including Ruby ERB and Pug/Jade.

Mapping the template engine to a specific payload family is necessary because SSTI exploitation requires engine-specific RCE and disclosure chains, utilizing distinct sandbox-bypass patterns tailored to the identified framework.