What problem does it solve? Server-side template injection is a high-impact vulnerability class that often leads directly to remote code execution, yet it is frequently missed because each template engine uses different syntax and exploitation primitives. This Skill provides the detection probes, engine fingerprinting logic, and engine-specific RCE escalation paths needed to find and validate SSTI during authorized security testing. ## Core Features & Use Cases - Multi-Engine Detection Probes: Math-expression payloads ({{77}}, ${77}, <%= 77 %>, #{77}, {77}) that fingerprint Jinja2, Twig, Freemarker, Velocity, ERB, Mako, Thymeleaf, Smarty, and Spring based on server-evaluated output. - Engine-Specific RCE Escalation: Class-walker payloads for Jinja2, registerUndefinedFilterCallback for Twig, backtick execution for ERB, and Execute-utility patterns for Freemarker and Velocity. - Injection Surface Guidance: Identifies high-yield test points including email templates, PDF/report generators, CMS preview features, invoice fields, and reflected URL parameters. - Use Case: During a bug bounty engagement, you notice a user's display name is reflected in a rendered email template. You submit {{77}}, observe 49 in the output, fingerprint the engine as Jinja2 with {{7'7'}}, then escalate to command execution and confirm with an out-of-band callback before reporting. ## Quick Start Test the name field of the target's email template feature with SSTI detection payloads and escalate to RCE if an engine is fingerprinted.
