ssti-twig

Exploit Twig/PHP server-side template injection to achieve remote code execution.

253|37|Updated Feb 22, 2026

Search Tags:#php #web security #twig #rce #ssti #template injection

Ready to run

npx skills add https://github.com/blacklanternsecurity/red-run --skill ssti-twig

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ssti-twig
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/ssti-twig
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill ssti-twig

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers identify and exploit Server-Side Template Injection (SSTI) vulnerabilities in PHP applications utilizing Twig or similar templating engines, aiming to achieve code execution.

Core Features & Use Cases

Engine Identification: Differentiates between Twig, Smarty, Blade, and Latte engines.
Vulnerability Assessment: Provides payloads to confirm template expression evaluation and identify engine versions.
Remote Code Execution (RCE): Offers various RCE payloads tailored to different Twig versions and bypass techniques.
Use Case: When a web application reveals {{7*7}} as 49, this Skill can be used to confirm it's Twig and then attempt to execute commands like id on the server.

Quick Start

Use the ssti-twig skill to attempt to execute the 'id' command on the target.

Frequently Asked Questions about ssti-twig

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I exploit server-side template injection in Twig to achieve remote code execution?▼

To exploit server-side template injection (SSTI) in Twig for remote code execution, you use version-specific payloads to evaluate template expressions and execute system commands. This involves confirming the vulnerability and applying tailored bypass techniques for modern PHP frameworks.

What is the best way to identify if a PHP web application uses Twig or another templating engine?▼

The best way to identify if a PHP web application uses Twig, Smarty, Blade, or Latte is by injecting template expressions like {{7*7}}. If the output evaluates to 49, the specific syntax and response can help differentiate the exact templating engine.

How do I perform blind SSTI exploitation when Twig template output is not visible?▼

To perform blind SSTI exploitation when Twig template output is not visible, you can use specialized payloads designed for out-of-band interaction or time-based verification. This allows you to confirm code execution without direct visual feedback from the application.

Does this SSTI exploitation approach work with modern PHP frameworks and different Twig versions?▼

Yes, this SSTI exploitation approach works with modern PHP frameworks by providing version-specific payloads and obfuscation techniques. It addresses bypass mechanisms to ensure remote code execution succeeds across various Twig configurations and restrictions.

How can I bypass security restrictions to execute commands during PHP template injection?▼

You can bypass security restrictions during PHP template injection by applying specific obfuscation and bypass techniques tailored for Twig. These methods help evade modern PHP framework filters to successfully achieve remote code execution.