vulns.co
/
mcp by GKData.io

SSTI hunting

User input that evaluates template syntax is RCE-class if the engine is server-side. Prove evaluation with harmless arithmetic, then stop at the primitive.

Playbooks

  • SSTI Hunting - A reflected ${7*7} is a gadget. Engine identification plus a sandbox escape is the report.

Gadgets

  • Prototype pollution gadget - Pollution without a gadget is often P4/informational. Pollution plus a sink (innerHTML, template, fetch URL, child_process) is the bug.
  • Server-side template evaluation - A reflection that evaluates template syntax is RCE-class if the engine is server-side. Prove evaluation with a harmless arithmetic or unique marker first.

Payloads

  • Server-Side Template Injection - Detect the engine with the polyglot first, then use the engine-specific chain to reach RCE. Reflected 49 from {{7*7}} means Jinja2/Twig-family; 7777777 from {{7*'7'}} distinguishes them.

Bypasses

  • SSTI by engine - Detect the engine with the math polyglot, then use the engine-specific chain to RCE. {{7*7}}→49 = Jinja2/Twig family; {{7*'7'}}→7777777 distinguishes Jinja2 from Twig.

Tools

  • nuclei - Template-based vulnerability scanner with thousands of community templates for CVEs, misconfigs, exposures, and takeovers. The workhorse of modern bug bounty.
  • kiterunner - Context-aware content discovery built for APIs. Uses real request templates (from 67k+ Swagger specs) instead of dumb path lists, catching routes that need specific methods/headers.
  • subzy - Purpose-built subdomain takeover checker with an up-to-date fingerprint set and low false positives. Complements nuclei's takeover templates.
  • tplmap - Server-side template injection scanner and exploiter. Confirms the engine (Jinja, Twig, Freemarker, ...) then tries a sandbox escape. Manual confirmation still required.

Questions

{{7*7}} came back as 49. Is that RCE?

It is evaluation. RCE is a second step and only if the program allows a bounded proof. Client-side Mustache is XSS, not SSTI.

Which engines still show up?

Jinja, Twig, Freemarker, Thymeleaf, Liquid, Pug, and email/PDF renderers sitting behind a 'preview' button.

This page is the public form of hunt_brief("ssti") on the MCP connector. Authorized testing only.