SSTI hunting
User input that evaluates template syntax is RCE-class if the engine is server-side. Prove evaluation with harmless arithmetic, then stop at the primitive.
Skill
No skill is linked for this class yet. Start with the playbook on this page.
Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.
Checklists
None linked for this class yet.
Disclosures
No public card yet.
Gadgets
- Server-side template evaluation - A reflection that evaluates template syntax is RCE-class if the engine is server-side. Prove evaluation with a harmless arithmetic or unique marker first.
Playbooks
- SSTI Hunting - A reflected ${7*7} is a gadget. Engine identification plus a sandbox escape is the report.
Payloads
- Server-Side Template Injection - Detect the engine with the polyglot first, then use the engine-specific chain to reach RCE. Reflected 49 from {{7*7}} means Jinja2/Twig-family; 7777777 from {{7*'7'}} distinguishes them.
Bypasses
- SSTI by engine - Detect the engine with the math polyglot, then use the engine-specific chain to RCE. {{7*7}}→49 = Jinja2/Twig family; {{7*'7'}}→7777777 distinguishes Jinja2 from Twig.
Questions
{{7*7}} came back as 49. Is that RCE?
It is evaluation. RCE is a second step and only if the program allows a bounded proof. Client-side Mustache is XSS, not SSTI.
Which engines still show up?
Jinja, Twig, Freemarker, Thymeleaf, Liquid, Pug, and email/PDF renderers sitting behind a 'preview' button.
This page is the linked pack hunt_brief("ssti") returns on the MCP connector. Authorized testing only.