Skip to content
HackIndex.io

OSWA · Module 11

Server-side Template Injection

Detect SSTI, fingerprint the template engine, and escalate to remote code execution across Jinja2, Twig, Freemarker, Pug, and Handlebars.

~1.5 h 2 resources Last updated September 26, 2026

Server-side template injection (SSTI) occurs when user input is embedded directly into a server-side template and evaluated by the template engine. Unlike XSS, which runs in the browser, SSTI executes in the template context on the server and frequently escalates to full remote code execution. The payload depends entirely on the engine (Jinja2, Twig, Freemarker, Pug, Handlebars), so identifying the engine is the critical first step.

SSTI Discovery

Detection begins with a polyglot probe that behaves differently if evaluated (for example, a mathematical expression that returns its result). Once injection is confirmed, engine identification narrows the payload set: different delimiters and error behaviors fingerprint Jinja2 versus Twig versus Freemarker. A decision tree of test payloads maps the response to a specific engine.

SSTI Exploitation

Each engine has its own path to RCE: Jinja2 through Python object traversal, Twig through PHP functions, Freemarker through Java, and Pug/Handlebars through Node.js. From code execution you spawn a reverse shell to reach the server. tplmap automates detection and exploitation across engines when manual payloads are slow, though understanding the manual chain is essential when it fails.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

Practice

Apply the module hands-on.

All OSWA practice machines