Ssti Server Side Template Injection

This is a comprehensive SSTI exploitation playbook that goes well beyond basic detection. It covers polyglot probes to fingerprint engines (Jinja2, Twig, FreeMarker, Velocity, ERB, Thymeleaf), then provides actual RCE chains for each including Jinja2 MRO subclass traversal and sandbox bypasses when underscores or dots are filtered. The routing is smart: it separates expression language injection (SpEL/OGNL) into its own skill and pushes specific CVE scenarios (Jira, Confluence, Spring Cloud Gateway) into a companion file. You get working payloads with correct syntax, not just theory. Load this when you're testing template rendering or preview features and need more than {{7*7}} to prove impact.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill ssti-server-side-template-injection --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Server-Side Template Injection (SSTI) — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert SSTI techniques. Covers polyglot detection probes, engine fingerprinting, Jinja2/FreeMarker/Twig/ERB RCE chains, client-side Angular SSTI, and bypass techniques. Base models often miss sandbox escape MRO chains and non-Jinja2 engines. For PHP CMS template eval, Jira SSTI, Confluence OGNL, and Spring Cloud Gateway SpEL, load the companion SCENARIOS.md.

0. RELATED ROUTING

Before using full engine-specific exploitation, you can first load:

First use the polyglot probe sequence at the top of this file for low-noise fingerprinting
expression-language-injection when ${7*7} or %{7*7} resolves in Java (SpEL/OGNL) — different attack surface from template engines