Skill UI

A comprehensive guide and set of payloads for detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities. This skill covers various template engines like Jinja2, Twig, Freemarker, and more, allowing users to achieve Remote Code Execution (RCE) during penetration testing.

This skill provides a comprehensive, structured methodology and checklist for identifying Remote Code Execution (RCE) vulnerabilities across various web applications. It covers advanced attack vectors such as OS command injection, Server-Side Template Injection (SSTI), insecure deserialization, file upload flaws, and XXE. Use this guide during web application penetration testing or bug bounty hunting to systematically discover arbitrary code execution paths.

This skill provides a comprehensive checklist and methodology for identifying Server-Side Template Injection (SSTI) vulnerabilities. It covers template engine identification (e.g., Jinja2, Twig), polyglot payload generation, systematic detection methods, and executing engine-specific Remote Code Execution (RCE) payloads. Ideal for security professionals testing web application input sanitization.

This expert playbook provides comprehensive techniques for exploiting Server-Side Template Injection (SSTI). It covers polyglot detection probes, engine fingerprinting (Jinja2, Twig, FreeMarker, etc.), sandbox escape mechanisms (MRO chains), and advanced bypass techniques. Essential reading for security researchers and penetration testers assessing application vulnerabilities.