domains / families / security / hunt-ssti

hunt-ssti

combined

Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once an engine is fingerprinted, escalate to RCE via the engine-specific class-walker, callback-registrar, or Execute-utility patterns documented in disclosed reports. Detection patterns: error messages reveal engine, blank or numeric eval reveals expression mode. Targets: email templates, PDF/report generators, CMS preview features, error pages with user input. Use when hunting RCE via template rendering, when content shows engine fingerprints, when finding endpoints that compose strings with user input before render.

When to use

• You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
• You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.
• Use when the target has any endpoint that renders user-controlled input through a server-side template engine. SSTI is one of the fastest paths to RCE — detection is a single `{{7*7}}` and escalation typically requires one more payload. SS…

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

Both copies describe the same SSTI hunting workflow (polyglot detection, engine fingerprinting, engine-specific RCE, blind/OOB detection), but each contains material steps the other lacks. The uphiago copy provides a broader engine matrix (including Velocity, Thymeleaf, Smarty, Mako) and a structured four-phase methodology with blind SSTI and chaining. The sickn33 copy adds an explicit authorization gate, an 'escalate straight to RCE' priority order, form-encoded vs JSON body handling, length-constrained field techniques, and CMS template-editor specifics (query-param id, fingerprint-before-RCE). Crowning one would hide these real alternatives.