Skill UI

A comprehensive guide and set of payloads for detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities. This skill covers various template engines like Jinja2, Twig, Freemarker, and more, allowing users to achieve Remote Code Execution (RCE) during penetration testing.

This skill provides a comprehensive checklist and methodology for identifying Server-Side Template Injection (SSTI) vulnerabilities. It covers template engine identification (e.g., Jinja2, Twig), polyglot payload generation, systematic detection methods, and executing engine-specific Remote Code Execution (RCE) payloads. Ideal for security professionals testing web application input sanitization.

This expert playbook provides comprehensive techniques for exploiting Server-Side Template Injection (SSTI). It covers polyglot detection probes, engine fingerprinting (Jinja2, Twig, FreeMarker, etc.), sandbox escape mechanisms (MRO chains), and advanced bypass techniques. Essential reading for security researchers and penetration testers assessing application vulnerabilities.