skills.rest
jayjpatel9717
jayjpatel9717COMMUNITY
Explore all skills by this author →
GitHub

SSTI Testing — ASHWATTHAMA

Detect Server-Side Template Injection vulnerabilities using probe payloads and identify template engines.

Updated Jun 3, 2026
Search Tags:#security testing#vulnerability detection#web application security#template injection#SSTI
One-click install
npx skills add https://github.com/jayjpatel9717/kurukshetra_updated --skill ssti-testing-ashwatthama
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: SSTI Testing — ASHWATTHAMA
Source: https://github.com/jayjpatel9717/kurukshetra_updated/tree/main/squads/pentest/agents/ashwatthama/skills/ssti-testing
Command: npx skills add https://github.com/jayjpatel9717/kurukshetra_updated --skill ssti-testing-ashwatthama

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, ffuf, tplmap, and includes scripts (resource) and references (resource) components.

What problem does it solve?

ASHWATTHAMA identifies and classifies Server-Side Template Injection (SSTI) vulnerabilities in web applications. It analyzes the response to probe payloads and classifies potential vulnerabilities based on the response.

Core Features & Use Cases

  • SSTI Detection: Identifies injection surfaces in web applications using template engines.
  • Engine Identification: Determines the template engine in use, if applicable.
  • Severity Classification: Assigns a severity rating based on the nature of the detected vulnerability.
  • Advanced Detection: Uses timing-based detection and error-based fingerprinting to identify blind SSTI vulnerabilities.
  • Use Case: ASHWATTHAMA can be used to test web applications for SSTI vulnerabilities during security audits or penetration testing.

Quick Start

Run ASHWATTHAMA on the web application at https://example.com to detect potential SSTI vulnerabilities.

Frequently Asked Questions about SSTI Testing — ASHWATTHAMA

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect Server-Side Template Injection vulnerabilities in a web application?▼

Server-Side Template Injection (SSTI) detection works by injecting mathematical and template-specific probe payloads into web application parameters and analyzing the HTTP response for execution evidence, error fingerprints, or timing delays.

What is blind SSTI detection and how does fingerprinting work?▼

Blind SSTI detection identifies hidden template injection vulnerabilities without direct output by using timing-based payload execution and error-based fingerprinting to infer the underlying template engine.

How do I identify the template engine used by a web application during security testing?▼

You identify the template engine during security testing by analyzing the application's response to specific probe payloads and error fingerprints, which determines the exact template framework in use.

Do I need Python and specific libraries to run SSTI vulnerability detection?▼

Yes, you need Python installed along with specific dependencies like requests, ffuf, and tplmap to perform template engine identification, payload injection, and error analysis for SSTI testing.

How is SSTI vulnerability severity classified during penetration testing?▼

SSTI vulnerability severity is classified during penetration testing based on the nature of the detected vulnerability, analyzing the server response to probe payloads to assign an appropriate severity rating.

What is the best way to find injection surfaces in web applications using template engines?▼

The best way to find injection surfaces in web applications using template engines is to send template-specific probe payloads to input fields and analyze the HTTP responses for execution evidence.

Related Skills

Explore More Software Engineering Skills→
AeonDaveAeonDave
15

tplmap

Automate SSTI detection and exploitation across template engines like Jinja2, Twig, and Smarty.

Community
Advanced
damacusdamacus
2

security-reviewer

Review codebases for vulnerabilities and generate structured security audit reports.

Community
Advanced
RifteoRifteo
30

ssti-hunter

Detect, fingerprint, and exploit Server-Side Template Injection vulnerabilities in web applications.

Official
Advanced
djankiesdjankies

reviewing-security

Detect security vulnerabilities in JavaScript/TypeScript codebases with Semgrep and pattern checks.

Community
Advanced