SSTImap

vladko312

Server-side template injection scanner and exploiter — the strongest of the SSTI probes.

Vulnerability Management Free & Open Source CLI Practiced in lab Cross-platform

Cyber Kill Chain & Defender Lifecycle

Attacker — Kill Chain
1 Reconnaissance
2 Weaponization
3 Delivery
4 Exploitation
5 Installation
6 Command & Control
7 Actions on Objectives
Defender — IR Lifecycle
8 Preparation
9 Detection & Analysis
10 Containment, Eradication & Recovery
11 Post-Incident Activity

Description

SSTImap is the successor to tplmap and the most capable of the template-injection scanners: it detects the engine, escalates to code execution where the engine allows it, and covers Jinja2 among many others.

The lesson from running it against a Django lab is what it cannot do. Django's own template language has no expression evaluation, so every probe comes back clean — a true negative that reads exactly like a missing detection. Add Jinja2 to the same project and the same command reaches remote code execution.

Use cases

  • Confirming an SSTI finding and identifying the template engine
  • Demonstrating that Django's DTL is not evaluable, and Jinja2 is
  • Escalating a template injection to code execution in a lab

Example

python sstimap.py -u "http://localhost:8000/greet/?name=test" --crawl 0

Related blog posts