ssti-server-side-template-injection — Skills

What it does

First use the polyglot probe sequence at the top of this file for low-noise fingerprinting

expression-language-injection when ${77} or %{77} resolves in Java (SpEL/OGNL) — different attack surface from template engines

Maccms 8.x PHP template eval — {if-A:phpinfo()}{endif-A} in vod-search, base64 bypass for webshell write

Jira CVE-2019-11581 — "Contact Administrators" form → Velocity template injection → command output in admin email

Spring Cloud Gateway SpEL (CVE-2022-22947) — actuator route injection with StreamUtils.copyToByteArray for output capture

Struts2 OGNL S2-045 (CVE-2017-5638) — Content-Type header OGNL injection with memberAccess / OgnlUtil blacklist clear

Confluence OGNL CVE-2021-26084 — createpage-entervariables.action with \u0027 unicode bypass

ssti server side template injection

Source

Repository: https://github.com/yaklang/hack-skills

ssti-server-side-template-injection FAQ

What does the ssti-server-side-template-injection skill do?

>- SSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content. First use the polyglot probe sequence at the top of this file for low-noise fingerprinting expression-language-injection when ${77} or %{77} resolves in Java (SpEL/OGNL) — different attack surface from template engines

How do I install ssti-server-side-template-injection?

Run: npx -y skills add https://github.com/yaklang/hack-skills --skill ssti-server-side-template-injection --agent claude-code — the source lives at github.com/yaklang/hack-skills.

Maintain ssti-server-side-template-injection?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[ssti-server-side-template-injection on getagentictools](https://getagentictools.com/skills/yaklang-hack-skills-ssti-server-side-template-injection?ref=badge)

npx agentictools info skills/yaklang-hack-skills-ssti-server-side-template-injection

The second line is the CLI lookup for this page — handy in READMEs and docs.