Web Application Hacking (Hands-On)
Server-Side Template Injection (SSTI)
Inject template syntax that the server evaluates — often leading to RCE.
SSTI occurs when user input is embedded directly into a server-side template (Jinja2, Twig, Freemarker, etc.) that is then rendered. Because templates can evaluate expressions, injecting template syntax can leak data or execute code.
The classic detection probe is a math expression:
Input: {{7*7}}
If the response shows 49, the input is being evaluated as a template → SSTI.From detection to impact
- Confirm evaluation with {{7*7}} (or ${7*7}, #{7*7} depending on engine).
- Fingerprint the engine (Jinja2 vs Twig vs others behave differently).
- Escalate through the object model to reach OS command execution.