hunt-ssti

When to Use

Use when the target has any endpoint that renders user-controlled input through a server-side template engine. SSTI is one of the fastest paths to RCE — detection is a single {{7*7}} and escalation typically requires one more payload. SSTI detection is reliable because template expressions evaluate BEFORE HTML encoding, so the result 49 appears in the rendered output even if the surrounding page is properly escaped.

Triggering contexts: email templates (order confirmations, password resets, welcome emails), PDF/report generators, CMS preview features (page builder previews, theme editors), error pages that reflect user input, profile bio/name/description fields rendered by server-side templates, URL path parameters reflected in templates, and inline translation strings with interpolation.

Quick Reference

# Detection polyglot — try this in EVERY user-controlled field
{{7*7}}${7*7}#{7*7}<%= 7*7 %>*{7*7}
# Expectation: 49 appears in the response (or 7777777 for Jinja2 string repetition)

# Fingerprint engine
{{7*'7'}}         # 7777777 = Jinja2 (Python), 49 = Twig (PHP)
${7*7}            # 49 = Freemarker, Velocity, Mako (all use ${...})
<%= 7*7 %>        # 49 = ERB (Ruby)
*{7*7}            # 49 = Spring Thymeleaf