ssti-server-side-template-injection

Server-side template injection is exploited for remote code execution by injecting malicious template directives. This Skill provides full RCE chains and step-by-step guides to execute commands on the target server after identifying the templating engine.

Detect the vulnerable template engine by using polyglot probes. This Skill identifies engines like Jinja2, FreeMarker, Twig, and ERB through specific payload responses to determine the exact underlying framework.

Bypass a Jinja2 sandbox during template injection by utilizing specific payload chains and bypass methods. This Skill provides dedicated techniques to escape sandbox restrictions in Jinja2 and achieve remote code execution.

You can perform SSTI attacks on AngularJS client-side template injection. This Skill includes specialized techniques for exploiting client-side template injection vulnerabilities within AngularJS applications.

Before attempting SSTI exploitation, you need knowledge of different templating engines and their associated vulnerabilities. Understanding how frameworks like Jinja2, FreeMarker, and Twig process templates is required to apply the appropriate payloads.