offensive-ssti

Name: offensive-ssti
Author: SnailSploit

2.8kstars447forks

How to install offensive-ssti?

snailsploit/claude-red/offensive-ssti

$npx -y skills add SnailSploit/Claude-Red --skill offensive-ssti

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Server-Side Template Injection (SSTI)
2
3	## Metadata
4	- Skill Name: ssti
5	- Folder: offensive-ssti
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/ssti.md
7
8	## Description
9	Server-Side Template Injection testing checklist: template engine identification (Jinja2, Twig, Freemarker, Pebble, Velocity), polyglot detection payloads, engine-specific RCE payloads, blind SSTI, and filter bypass. Use when testing web apps for template injection vulnerabilities.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`SSTI, server-side template injection, Jinja2, Twig, Freemarker, Pebble, Velocity, template injection, template RCE, polyglot payload, template engine, blind SSTI`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Server-Side Template Injection (SSTI)
29
30	Template engines are software used to generate dynamic web pages. When user input is unsafely embedded into templates, server-side template injection (SSTI) can occur, potentially leading to Remote Code Execution (RCE).
31
32	## Shortcut
33
34	- Look for all locations where user input is reflected or used in the response (URL parameters, POST data, HTTP headers, JSON data, etc.).
35	- Inject template syntax characters/polyglots like `${{<%[%'"}}%\`, `{{7'7'}}`, `{{77}}` into inputs. Check for errors, mathematical evaluation (e.g., `49` instead of `7*7`), or missing/changed reflections.
36	- Verify server-side evaluation (e.g., math works) vs. client-side XSS.
37	- Use engine-specific syntax (e.g., `${7/0}`, `{{7/0}}`, `<%= 7/0 %>`), known variable names (`{{config}}`, `{$smarty}`), or error messages to identify the template engine (use a decision tree like PortSwigger's or HackTricks').
38	- Look up payloads specific to the identified engine and backend language.
39	- Use engine-specific payloads (see Methodologies) to read files, execute commands, access internal data, or escape sandboxes.
40	- Create a non-destructive proof of concept (e.g., `touch ssti_poc_by_YOUR_NAME.txt` via RCE).
41
42	## Mechanisms
43
44	Server-Side Template Injection (SSTI) occurs when attacker-controlled input is embedded unsafely into a server-side template. Instead of treating the input as data, the template engine executes it as part of the template's code. This allows injecting template directives to execute arbitrary code, access server data, or perform actions as the application.
45
46	Root Cause: Concatenating or directly rendering user input within a template string without proper sanitization or using insecure template functions.
47
48	- Misusing “helper” APIs that compile raw strings at runtime, such as `render_template_string`, `Template::render_inline`, or `Template.compile`, which appear safe but execute attacker‑supplied data.
49
50	### Vulnerable Example 1 (Simple Jinja2)
51
52	The following program takes user input and concatenates it directly into a template string:
53
54	```python
55	# Assume user_input comes from an HTTP request parameter
56	from jinja2 import Template
57	tmpl = Template("<html><h1>The user's name is: " + user_input + "</h1></html>")
58	print(tmpl.render())
59	```
60
61	If `user_input` is `{{1+1}}`, the engine executes the expression:
62
63	```html
64	<html>
65	<h1>The user's name is: 2</h1>
66	</html>
67	```
68
69	### Vulnerable Example 2 (Flask/Jinja2)
70
71	```python
72	from flask import Flask, request, render_template_string
73
74	app = Flask(__name__)
75
76	@app.route('/')
77	def home():
78	# Vulnerable: Directly renders user input from 'user' query parameter
79	if request.args.get('user'):
80	return render_template_string('Welcome ' + request.args.get('user'))
81	else:
82	return render_template_string('Hello World!')
83
84	# Attacker URL: http://<server>/?user={{7*7}}
85	# Response: Welcome 49
86	```
87
88	### Secure Example (Flask/Jinja2)
89
90	```python
91	from flask import Flask, request, render_template_string
92
93	app = Flask(__name__)
94
95	@app.route('/')
96	def home():
97	# Secure: Passes user input as a variable to the template
98	if request.args.get('user'):
99	# The template engine treats 'username' as data, not code
100	return render_template_string('Welcome {{ username }}', username=request.args.get('user'))
101	else:
102	# ...
103	```
104
105	## Hunt
106
107	### Preparation
108
109	- Identify all user-controlled input points: URL parameters, POST data, HTTP headers (Referer, User-Agent, custom headers), JSON keys/values, etc.
110	- Use tools like `waybackurls` and `qsreplace` to generate fuzzing lists for parameters:
111	```bash
112	waybackurls http://target.com \| qsreplace "ssti{{9*9}}" > fuzz.txt
113	ffuf -u FUZZ -w fuzz.txt -replay-proxy http://127.0.0.1:8080/ -mr "ssti81"
114	# Check Burp Repeater/Logger++ for responses containing the evaluated result (e.g., 81)
115	```
116
117	### Detection
118
119	- Initial F

People who liked this also viewed

6 picks

Type

offensive-ssti

2.8kstars447forks

View on GitHub

How to install offensive-ssti?

snailsploit/claude-red/offensive-ssti

$npx -y skills add SnailSploit/Claude-Red --skill offensive-ssti

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Server-Side Template Injection (SSTI)
2
3	## Metadata
4	- Skill Name: ssti
5	- Folder: offensive-ssti
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/ssti.md
7
8	## Description
9	Server-Side Template Injection testing checklist: template engine identification (Jinja2, Twig, Freemarker, Pebble, Velocity), polyglot detection payloads, engine-specific RCE payloads, blind SSTI, and filter bypass. Use when testing web apps for template injection vulnerabilities.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`SSTI, server-side template injection, Jinja2, Twig, Freemarker, Pebble, Velocity, template injection, template RCE, polyglot payload, template engine, blind SSTI`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Server-Side Template Injection (SSTI)
29
30	Template engines are software used to generate dynamic web pages. When user input is unsafely embedded into templates, server-side template injection (SSTI) can occur, potentially leading to Remote Code Execution (RCE).
31
32	## Shortcut
33
34	- Look for all locations where user input is reflected or used in the response (URL parameters, POST data, HTTP headers, JSON data, etc.).
35	- Inject template syntax characters/polyglots like `${{<%[%'"}}%\`, `{{7'7'}}`, `{{77}}` into inputs. Check for errors, mathematical evaluation (e.g., `49` instead of `7*7`), or missing/changed reflections.
36	- Verify server-side evaluation (e.g., math works) vs. client-side XSS.
37	- Use engine-specific syntax (e.g., `${7/0}`, `{{7/0}}`, `<%= 7/0 %>`), known variable names (`{{config}}`, `{$smarty}`), or error messages to identify the template engine (use a decision tree like PortSwigger's or HackTricks').
38	- Look up payloads specific to the identified engine and backend language.
39	- Use engine-specific payloads (see Methodologies) to read files, execute commands, access internal data, or escape sandboxes.
40	- Create a non-destructive proof of concept (e.g., `touch ssti_poc_by_YOUR_NAME.txt` via RCE).
41
42	## Mechanisms
43
44	Server-Side Template Injection (SSTI) occurs when attacker-controlled input is embedded unsafely into a server-side template. Instead of treating the input as data, the template engine executes it as part of the template's code. This allows injecting template directives to execute arbitrary code, access server data, or perform actions as the application.
45
46	Root Cause: Concatenating or directly rendering user input within a template string without proper sanitization or using insecure template functions.
47
48	- Misusing “helper” APIs that compile raw strings at runtime, such as `render_template_string`, `Template::render_inline`, or `Template.compile`, which appear safe but execute attacker‑supplied data.
49
50	### Vulnerable Example 1 (Simple Jinja2)
51
52	The following program takes user input and concatenates it directly into a template string:
53
54	```python
55	# Assume user_input comes from an HTTP request parameter
56	from jinja2 import Template
57	tmpl = Template("<html><h1>The user's name is: " + user_input + "</h1></html>")
58	print(tmpl.render())
59	```
60
61	If `user_input` is `{{1+1}}`, the engine executes the expression:
62
63	```html
64	<html>
65	<h1>The user's name is: 2</h1>
66	</html>
67	```
68
69	### Vulnerable Example 2 (Flask/Jinja2)
70
71	```python
72	from flask import Flask, request, render_template_string
73
74	app = Flask(__name__)
75
76	@app.route('/')
77	def home():
78	# Vulnerable: Directly renders user input from 'user' query parameter
79	if request.args.get('user'):
80	return render_template_string('Welcome ' + request.args.get('user'))
81	else:
82	return render_template_string('Hello World!')
83
84	# Attacker URL: http://<server>/?user={{7*7}}
85	# Response: Welcome 49
86	```
87
88	### Secure Example (Flask/Jinja2)
89
90	```python
91	from flask import Flask, request, render_template_string
92
93	app = Flask(__name__)
94
95	@app.route('/')
96	def home():
97	# Secure: Passes user input as a variable to the template
98	if request.args.get('user'):
99	# The template engine treats 'username' as data, not code
100	return render_template_string('Welcome {{ username }}', username=request.args.get('user'))
101	else:
102	# ...
103	```
104
105	## Hunt
106
107	### Preparation
108
109	- Identify all user-controlled input points: URL parameters, POST data, HTTP headers (Referer, User-Agent, custom headers), JSON keys/values, etc.
110	- Use tools like `waybackurls` and `qsreplace` to generate fuzzing lists for parameters:
111	```bash
112	waybackurls http://target.com \| qsreplace "ssti{{9*9}}" > fuzz.txt
113	ffuf -u FUZZ -w fuzz.txt -replay-proxy http://127.0.0.1:8080/ -mr "ssti81"
114	# Check Burp Repeater/Logger++ for responses containing the evaluated result (e.g., 81)
115	```
116
117	### Detection
118
119	- Initial F

People who liked this also viewed

6 picks

Type