ssti-twig

What problem does it solve?

This Skill helps penetration testers identify and exploit Server-Side Template Injection (SSTI) vulnerabilities in PHP applications utilizing Twig or similar templating engines, aiming to achieve code execution.

Core Features & Use Cases

• Engine Identification: Differentiates between Twig, Smarty, Blade, and Latte engines.
• Vulnerability Assessment: Provides payloads to confirm template expression evaluation and identify engine versions.
• Remote Code Execution (RCE): Offers various RCE payloads tailored to different Twig versions and bypass techniques.
• Use Case: When a web application reveals {{7*7}} as 49, this Skill can be used to confirm it's Twig and then attempt to execute commands like id on the server.

Quick Start

Use the ssti-twig skill to attempt to execute the 'id' command on the target.