web-vuln-ssti

What this skill does

Detects Server-Side Template Injection (SSTI) vulnerabilities by injecting polyglot probes and engine-specific payloads into user-controlled inputs reflected in server responses. Identifies the template engine in use (Jinja2, Twig, Freemarker, ERB, Thymeleaf, Pug) from error messages or mathematical output, then escalates to Remote Code Execution (RCE) payloads to confirm impact.

When to use

• When user input appears to be rendered inside a server-side template (e.g. name fields, subject lines, custom report templates, URL paths, HTTP headers)
• When a response reflects user input with unexpected evaluation (e.g. {{7*7}} returns 49)
• When error messages mention template engine names (Jinja2, Twig, FreeMarker, Velocity, Smarty, etc.)
• When testing web applications built on Python (Flask/Django), PHP (Laravel/Symfony), Java (Spring/Thymeleaf), Ruby (Rails/ERB), or Node.js (Pug/Nunjucks)

Prerequisites

• curl must be installed
• HTTP/HTTPS access to the target endpoint
• Knowledge of the parameter name that reflects user input in the response

Inputs