web-vuln-ssti

What this skill does

Detects Server-Side Template Injection (SSTI) vulnerabilities by injecting polyglot probes and engine-specific payloads into user-controlled inputs reflected in server responses. Identifies the template engine in use (Jinja2, Twig, Freemarker, ERB, Thymeleaf, Pug) from error messages or mathematical output, then escalates to Remote Code Execution (RCE) payloads to confirm impact.

When to use

• When user input appears to be rendered inside a server-side template (e.g. name fields, subject lines, custom report templates, URL paths, HTTP headers)
• When a response reflects user input with unexpected evaluation (e.g. {{7*7}} returns 49)
• When error messages mention template engine names (Jinja2, Twig, FreeMarker, Velocity, Smarty, etc.)
• When testing web applications built on Python (Flask/Django), PHP (Laravel/Symfony), Java (Spring/Thymeleaf), Ruby (Rails/ERB), or Node.js (Pug/Nunjucks)

Prerequisites

• curl must be installed
• HTTP/HTTPS access to the target endpoint
• Knowledge of the parameter name that reflects user input in the response

Inputs

Variable	Description	Example
TARGET_URL	Full URL of the vulnerable endpoint	https://app.example.com/greet
PARAM	Query or POST parameter that reflects input	name
METHOD	HTTP method (GET or POST)	GET
EXTRA_HEADERS	Additional headers required (e.g. auth token)	Authorization: Bearer <token>

Workflow

Step 1: Identify user input reflected in responses

TARGET_URL="https://app.example.com/greet"
PARAM="name"
METHOD="GET"
EXTRA_HEADERS=""

echo "=== Step 1: Confirm reflection ==="

send_probe() {
  local payload="$1"
  local encoded
  encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$payload'))")

  if [ "$METHOD" = "POST" ]; then
    curl -s -X POST "$TARGET_URL" \
      --data "${PARAM}=${encoded}" \
      ${EXTRA_HEADERS:+-H "$EXTRA_HEADERS"} \
      --max-time 10 2>&1
  else
    curl -s -X GET "${TARGET_URL}?${PARAM}=${encoded}" \
      ${EXTRA_HEADERS:+-H "$EXTRA_HEADERS"} \
      --max-time 10 2>&1
  fi
}

echo "--- Baseline (literal string) ---"
send_probe "SSTI_TEST_12345" | grep -o "SSTI_TEST_12345" | head -3