skills.rest
langbyyi
langbyyiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

ssti-server-side-template-injection

Detect and exploit server-side template injection vulnerabilities across web applications.

96|1|Updated Jun 4, 2026
Search Tags:#jinja2#web-security#penetration-testing#ssti#freemarker#template-injection#remote-code-execution
One-click install
npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill ssti-server-side-template-injection-langbyyi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ssti-server-side-template-injection
Source: https://github.com/langbyyi/CyberStrikeAI-SRC/tree/main/skills/ssti-server-side-template-injection
Command: npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill ssti-server-side-template-injection-langbyyi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Server-side template injection (SSTI) vulnerabilities are frequently missed by standard security scanners and can enable full remote code execution on vulnerable servers, posing critical risk to organizational systems. This Skill provides a comprehensive, engine-agnostic playbook to identify, fingerprint, and exploit these flaws across a wide range of templating platforms.

Core Features & Use Cases

  • Multi-engine RCE support: Includes working exploit chains for Jinja2, FreeMarker, Twig, Velocity, ERB, Thymeleaf, and client-side Angular SSTI, plus niche enterprise scenarios like Jira Velocity injection, Confluence OGNL, and Spring Cloud Gateway SpEL.
  • Low-noise and blind detection: Features polyglot probes, mathematical fingerprinting, and blind SSTI techniques (boolean, time, OOB) for environments with no direct output or strict WAF filtering.
  • Sandbox bypass techniques: Covers methods to bypass common Jinja2 sandbox restrictions including underscore, dot, and keyword filtering. Use case: A penetration tester assessing a Flask application can use this Skill to first run low-noise polyglot probes to confirm SSTI presence, then escalate to full RCE via Jinja2 MRO subclass traversal chains.

Quick Start

Use the ssti-server-side-template-injection skill to test the target application's template rendering endpoints for SSTI vulnerabilities and escalate to remote code execution if the flaw is confirmed.

Frequently Asked Questions about ssti-server-side-template-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for server-side template injection across different template engines?▼

Server-side template injection is detected using low-noise polyglot probes and mathematical fingerprinting to identify vulnerable rendering endpoints across engines like Jinja2, FreeMarker, and Twig.

Can I get remote code execution in Jinja2 if the sandbox restricts underscores and dots?▼

Remote code execution in Jinja2 sandboxes is achieved by applying specific bypass techniques that circumvent underscore, dot, and keyword filtering to execute MRO subclass traversal chains.

How does blind SSTI exploitation work when the web application has no direct output?▼

Blind SSTI exploitation relies on boolean, time, and out-of-band techniques to infer template injection success and extract data or execute commands without direct visual output.

Does this SSTI exploitation approach support Java enterprise environments like Spring and Jira?▼

SSTI exploitation supports Java enterprise platforms by providing working RCE chains for Spring Cloud Gateway SpEL, Confluence OGNL, Jira Velocity, and standard Thymeleaf injection.

What is the best way to confirm SSTI vulnerabilities during a penetration test without triggering WAFs?▼

Low-noise polyglot probes are the best way to confirm SSTI vulnerabilities during penetration testing, designed specifically to avoid triggering strict Web Application Firewall filtering.

Are client-side Angular SSTI vulnerabilities covered alongside backend template engines?▼

Client-side Angular SSTI vulnerabilities are covered alongside backend template engines, providing comprehensive engine-agnostic exploitation playbooks for full stack security assessments.

Related Skills

Explore More Software Engineering Skills→
RifteoRifteo
30

hpp-hunter

Automate HTTP Parameter Pollution and WAF bypass vulnerability testing.

Official
Advanced
phuonghxphuonghx
1

red-team-tactics

Implement red team exercises aligned with the MITRE ATT&CK framework.

Community
Advanced
amano--amano--

burp-suite

Intercept HTTP traffic and test web applications for security vulnerabilities.

Community
Advanced
uphiagouphiago
1.1k

hunt-fastapi

Detect FastAPI-specific vulnerabilities including OpenAPI schema exposure and DI authorization gaps.

Community
Intermediate