skills.rest
AeonDave
AeonDaveCOMMUNITY
Explore all skills by this author →
GitHub

tplmap

Automate SSTI detection and exploitation across template engines like Jinja2, Twig, and Smarty.

15|1|Updated Feb 12, 2026
Search Tags:#exploitation#vulnerability detection#web application security#rce#ssti#tplmap
One-click install
npx skills add https://github.com/AeonDave/malskill --skill tplmap
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: tplmap
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/web-app/tplmap
Command: npx skills add https://github.com/AeonDave/malskill --skill tplmap

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the detection and exploitation of Server-Side Template Injection (SSTI) vulnerabilities across a wide range of template engines, enabling security professionals to identify and demonstrate Remote Code Execution (RCE) risks.

Core Features & Use Cases

  • Automated SSTI Detection: Scans web applications for vulnerabilities in popular template engines like Jinja2, Twig, Smarty, and others.
  • Exploitation: Facilitates achieving Remote Code Execution (RCE) through identified SSTI flaws.
  • File Operations: Supports uploading and downloading files to and from the target server via SSTI.
  • Use Case: A penetration tester can use this Skill to quickly assess a web application for SSTI vulnerabilities and, if found, demonstrate the potential impact by executing commands on the server.

Quick Start

Use the tplmap skill to detect SSTI vulnerabilities on the target URL http://example.com/page?name=* by running the command python2 tplmap.py -u "http://example.com/page?name=*"

Frequently Asked Questions about tplmap

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect Server-Side Template Injection vulnerabilities in web applications?▼

You can detect Server-Side Template Injection (SSTI) by scanning target web application URLs to identify exploitable template engines like Jinja2, Twig, and Smarty using automated detection tools.

Can I achieve Remote Code Execution through SSTI exploitation?▼

Yes, Remote Code Execution (RCE) can be achieved by exploiting identified Server-Side Template Injection (SSTI) flaws, allowing you to execute commands directly on the target server.

Does this SSTI detection method support file operations on the target server?▼

Yes, this SSTI detection method supports file operations by enabling you to upload and download files to and from the target server through the identified template injection vulnerabilities.

What is the best way to scan a URL parameter for template injection flaws?▼

The best way to scan a URL parameter for template injection flaws is to run an automated SSTI detection script against the target URL, appending an injection marker to the vulnerable parameter.

Do I need Python to run automated Server-Side Template Injection detection?▼

Yes, you need a Python 2 or Python 3 environment to run the automated Server-Side Template Injection (SSTI) detection and exploitation scripts against your target web applications.

Related Skills

Explore More Software Engineering Skills→
SkobynSkobyn

security-arsenal

Provide security payloads and bypass techniques for testing web application vulnerabilities.

Community
Advanced
AcczdyAcczdy
2

conducting-internal-network-penetration-test

Simulate internal network penetration tests to reveal lateral movement and privilege escalation paths.

Community
Advanced
zebbernzebbern
4.5k

Burp Suite Web Application Testing

Automate Burp Suite web application security testing across intercept, modify, scan, and manual workflows.

Community
Advanced
yhy0yhy0
518

rce

Automate detection and exploitation workflows for remote code execution vulnerabilities.

Community
Advanced