ssti-hunter
Installation
SKILL.md
SSTI Hunter — Server-Side Template Injection
SSTI occurs when user input is embedded directly into a template and evaluated by the engine. The result is almost always Remote Code Execution on the server.
Phase 1 — Find Injection Points
| Surface | Example |
|---|---|
| URL query parameters | /search?q=Hello |
| URL path segments | /greet/John |
| HTTP headers | User-Agent, Referer, custom headers |
| Form inputs / POST body | Name, email, message fields |
| Cookies | username=John, theme/locale cookies |
| File names | Upload endpoints echoing the original filename |
| Email templates | Name field in password reset emails |
| Profile fields | Display name, bio, job title |