SSTI Hunting

Tags: ssti, rce, templates

Level: advanced

Method

1. Find template-looking reflections

   Error pages, emails, invoices, PDF, notification previews, filename in templates.

   cat urls.txt | qsreplace '{{7*7}}' 

   Copy

   Tools: ffuf, qsreplace

2. Identify the engine

   Jinja, Twig, Freemarker, Velocity, Pebble, Smarty, ERB, Pug, Handlebars, Thymeleaf, Go html/template. Polyglot ${{<%[%'"}}%\ is a start.

   Tools: tplmap

3. Read-only proof

   Evaluate 7*7 or dump a config key. Do not drop a shell on a production box.

4. Sandbox escape only if needed

   If the program wants RCE impact, use a documented gadget for that engine. Keep it inert (id / whoami equivalent).

   Tools: tplmap

Field notes

• Email templates and PDF invoices are higher-signal than public 404 pages.
• Go templates and React are not SSTI. Do not waste time on {{name}} in a SPA.

References

• https://portswigger.net/web-security/server-side-template-injection