skills.rest
utsavthakur
utsavthakurCOMMUNITY
Explore all skills by this author →
GitHub

ssti-server-side-template-injection

Detect and exploit Server-Side Template Injection vulnerabilities in web applications.

Updated Jun 11, 2026
Search Tags:#security research#RCE#web application testing#template engines#SSTI
One-click install
npx skills add https://github.com/utsavthakur/agenticskills --skill ssti-server-side-template-injection-utsavthakur
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ssti-server-side-template-injection
Source: https://github.com/utsavthakur/agenticskills/tree/main/ssti-server-side-template-injection
Command: npx skills add https://github.com/utsavthakur/agenticskills --skill ssti-server-side-template-injection-utsavthakur

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill assists in identifying and exploiting Server-Side Template Injection (SSTI) vulnerabilities within server-side rendered templates, enabling security researchers to uncover potential security issues.

Core Features & Use Cases

  • Engine Detection: Fingerprint various template engines (e.g., Jinja2, Twig, FreeMarker, Velocity) by analyzing response content or error messages.
  • Exploitation Techniques: Provide RCE chains and bypass techniques for multiple template engines.
  • Real-World Scenarios: Include examples from actual CVEs like Jira SSTI (CVE-2019-11581), Spring Cloud Gateway SpEL Injection (CVE-2022-22947), and more.
  • Universal Detection: Offer a polyglot probe and mathematical detection payloads for blind SSTI confirmation.

Quick Start

Run the skill to automatically detect and exploit SSTI vulnerabilities in web applications.

Frequently Asked Questions about ssti-server-side-template-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect Server-Side Template Injection vulnerabilities in web applications?▼

Server-Side Template Injection vulnerabilities are detected using universal polyglot probes and mathematical detection payloads to confirm blind SSTI by analyzing response content or error messages for template engine execution.

What is the best way to fingerprint template engines like Jinja2 or Twig during security testing?▼

Template engine fingerprinting for Jinja2, Twig, FreeMarker, and Velocity is performed by injecting specific probes and analyzing the resulting response content or error messages to identify the active engine.

How do I achieve remote code execution after finding an SSTI vulnerability?▼

Remote code execution via SSTI is achieved by applying specific RCE chains and bypass techniques tailored to the identified template engine to execute arbitrary commands on the server.

Can I test real-world CVEs like Spring Cloud Gateway SpEL injection using this approach?▼

Real-world CVEs like Spring Cloud Gateway SpEL Injection (CVE-2022-22947) and Jira SSTI (CVE-2019-11581) are covered with applicable exploitation techniques for testing known template injection scenarios.

Does blind SSTI detection work without visible template rendering in the response?▼

Blind SSTI detection works without visible rendering by using mathematical detection payloads and polyglot probes that trigger observable time delays or out-of-band interactions to confirm execution.

Related Skills

Explore More Software Engineering Skills→
cmndcntrlcybercmndcntrlcyber
3

hunt-ssti

Detect and exploit server-side template injection vulnerabilities across template engines.

Community
Advanced
jcastillotxjcastillotx

Linux Privilege Escalation

Enumerate Linux systems for privilege escalation paths to root.

Community
Advanced
Prohao42Prohao42
120

ssti-server-side-template-injection

Detect server-side template injection vulnerabilities using polyglot probes and engine fingerprinting.

Community
Advanced
zebbernzebbern
5

ssti-poc

Detect and exploit server-side template injection vulnerabilities to achieve remote code execution.

Community
Advanced