githubEdit

SSTI

PayloadsAllTheThings SSTIarrow-up-right | SSTI Payloadsarrow-up-right


Confirm SSTI

Break Template Syntax

${{<%[%'"}}%\.

If this causes a server error, SSTI is likely.

Basic Math Test

{{7*7}}
${7*7}
<%= 7*7 %>
${{7*7}}
#{7*7}
*{7*7}

If 49 appears, template is executing code.


Identify Template Engine

Payload
Result
Engine

${7*7}

49

Freemarker, Thymeleaf, etc.

{{7*7}}

49

Jinja2, Twig, etc.

{{7*'7'}}

7777777

Jinja2

{{7*'7'}}

49

Twig

<%= 7*7 %>

49

ERB (Ruby)

#{7*7}

49

Pebble, Thymeleaf


Jinja2 (Python/Flask)

Information Disclosure

Local File Read

RCE

Alternative Paths to RCE


Twig (PHP/Symfony)

Information Disclosure

Local File Read (Symfony only)

RCE


SSTImap (Automated Tool)


Other Engines Quick Reference

ERB (Ruby)

Freemarker (Java)

Pebble (Java)


Resources

Last updated