skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

vuln-ssti

Detect server-side template injection vulnerabilities using mathematical expression probes.

Updated Jul 30, 2026
Search Tags:#security#vulnerability#injection#web-security#pentest#ssti
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill vuln-ssti
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vuln-ssti
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/vuln-ssti
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill vuln-ssti

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the challenge of identifying and verifying Server-Side Template Injection (SSTI) vulnerabilities in web applications, which can lead to critical remote code execution if left unpatched.

Core Features & Use Cases

  • Universal Probes: Detects SSTI across multiple engines including Jinja2, Twig, FreeMarker, and ERB using mathematical expression testing.
  • Engine Fingerprinting: Confirms the specific template engine in use to tailor further assessment.
  • Safe Validation: Provides a structured, gated workflow that prevents unauthorized destructive actions while confirming the vulnerability.

Quick Start

Use the vuln-ssti skill to test the target parameter on the provided URL for template injection vulnerabilities.

Frequently Asked Questions about vuln-ssti

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for server-side template injection vulnerabilities in web applications?▼

To test for server-side template injection (SSTI) vulnerabilities, inject mathematical expression probes into target parameters to detect if the template engine evaluates them. This confirms the vulnerability and can lead to remote code execution if left unpatched.

What template engines are vulnerable to SSTI?▼

Template engines vulnerable to SSTI include Jinja2, Twig, FreeMarker, and ERB. Mathematical expression testing can detect and fingerprint these engines during security assessments to confirm if they evaluate injected input.

What is the safest way to validate an SSTI vulnerability without causing damage?▼

The safest way to validate an SSTI vulnerability is using a structured, gated workflow that enforces strict adherence to authorization gates and scope definitions before executing any probe or confirmation command.

How does mathematical expression testing detect template injection?▼

Mathematical expression testing detects template injection by injecting specific calculation probes into web application parameters. If the template engine evaluates the expression rather than rendering it as static text, the SSTI vulnerability is confirmed.

Can I use SSTI validation for penetration testing on unauthorized targets?▼

No, SSTI validation requires strict adherence to authorization gates and scope definitions before executing any probe. You must only test web applications where you have explicit permission to perform security assessments.

Related Skills

Explore More Software Engineering Skills→
qa-amanqa-aman
19

pentest-scope

Define penetration testing engagement scope with targets, objectives, and authorization.

Community
Intermediate
bpnrockstarbpnrockstar

hunt-ssti

Detect server-side template injection vulnerabilities and escalate to remote code execution.

Community
Advanced
Chid0kChid0k

ssti-detect

Detect Server-Side Template Injection vulnerabilities in web applications.

Community
Advanced
reececoakes99reececoakes99

web-inject

Test payment checkout systems for XSS, SQLi, command, and template injection vulnerabilities.

Community
Advanced