domains / families / security / exploiting-template-injection-vulnerabilities

exploiting-template-injection-vulnerabilities

separate

Detects and exploits Server-Side Template Injection (SSTI) vulnerabilities

When to use

• During authorized penetration tests when user input is rendered through a server-side template engine
• When testing error pages, email templates, PDF generators, or report builders that include user-supplied data
• For assessing applications that allow users to customize templates or notification messages
• When identifying potential SSTI in parameters that reflect arithmetic results (e.g., `{{7*7}}` returns `49`)
• During security assessments of CMS platforms, marketing tools, or any application with templating functionality

Skill page

Source