Agent skill · security · yaklang
ssti-server-side-template-injection
SSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content.
Why this skill is useful
Adds extensive attack techniques, payloads, and detection methods for various templating engines that the AI cannot generate on its own.
What it needs
About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Server-Side Template Injection (SSTI) — Expert Attack Playbook AI LOAD INSTRUCTION: Expert SSTI techniques. Covers polyglot detection probes, engine fingerprinting, Jinja2/FreeMarker/Twig/ERB RCE chains, client-side Angular SSTI, and bypass techniques. Base models often miss sandbox escape MRO chains and non-Jinja2 engines. For PHP CMS template eval, Jira SSTI, Confluence OGNL, and Spring Cloud Gateway SpEL, load the companion SCENARIOS.md. 0. RELATED ROUTING Before using full engine-specific exploitation, you can first load: First use the polyglot probe sequence at the top of this file for low-noise fingerprinting expression-language-injection when ${77} or %{77} resolves in Java (SpEL/OGNL) — different attack surface from template engines Extended Scenarios Also load SCENARIOS.md when you need: Maccms 8.x PHP template eval — {if-A:phpinfo()}{endif-A} in vod-search, base64 bypass for webshell write Jira CVE-2019-11581 — "Contact Administrators" form → Velocity template injection → command output in admin email Spring Cloud Gateway SpEL (CVE-2022-22947) — actuator route injection with StreamUtils.copyToByteArray for output capture Struts2 OGNL S2-045 (CVE-2017-5638) — Content-Type header OGNL injection with memberAccess / OgnlUtil blacklist clear Confluence OGNL CVE-2021-26084 — createpage-entervariables.action with \u0027 unicode bypass SSTI vs EL injection disambiguation guide Additional template engines: ASP.NET Razor, Elixir EEx, PHP Smarty/Latte/Blade, JS Pug/Handlebars/Nunjucks/EJS/Lodash + universal detection + blind SSTI + Flask PIN calculation SCENARIOS.md reference (§7–§11): For expanded payloads and engine-specific notes on Razor, EEx/LEEx/HEEx, PHP stacks, JavaScript template engines, the universal polyglot probe, mathematical fingerprinting, blind SSTI (boolean / time / OOB), and Flask debug PIN prerequisites, see SCENARIOS.md. This skill keeps a short checklist in §13–§15. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/ssti-server-side-template-injection