SSTIninja

A Server-Side Template Injection (SSTI) detection and exploitation tool. Given a URL and a parameter, it fingerprints the template engine, probes WAF / sandbox restrictions, searches for a working payload, and verifies RCE end-to-end.

Supports Jinja2, Tornado, Mako, Twig, and Smarty.

Install

# one-shot, no install
uvx --from git+https://github.com/WangYihang/sstininja sstininja --help

# or install
pip install git+https://github.com/WangYihang/sstininja

# or from a local clone
pip install -e .

Requires Python 3.11+.

Use

Exploit a remote URL:

sstininja probe --url 'http://target/page' --param name

Exploit a local Jinja2 sandbox (research / CTF):

sstininja probe --context empty_string --sandbox none --target os.popen

Run the benchmark suite:

sstininja bench run

Run the HTTP eval corpus:

sstininja eval run --corpus eval/corpus/local_flask.toml

Run sstininja --help to see all commands.