Skip to content
Get packs

Offensive SSTI Testing Methodology

Guides an agent through finding and exploiting server-side template injection in web apps.

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This is a written playbook that teaches an AI agent how to test web applications for server-side template injection, a flaw where user input is evaluated as code by the server's template engine. Once installed, the agent can recognize which template engine (such as Jinja2, Twig, or Freemarker) a site uses, walk through probe payloads, and describe chains that lead to code execution, file reads, or secret disclosure. It is written for penetration testers and security students, and it mentions the tplmap tool.

Great for

  • Penetration testers doing authorized web application assessments
  • Security students learning how template injection works and how it is found
  • Bug bounty researchers working within a program's scope

Skip it if

  • Testing systems you do not own or have written permission to test, because the payloads are active attacks that can cause code execution and data theft
  • Developers looking for a way to prevent SSTI; the file is about exploitation, not defense, so use secure coding guidance instead

Try asking

  • “Help me fingerprint which template engine this login page uses from its error messages.”
  • “Walk me through a non-destructive SSTI proof of concept for my authorized test of a Flask app.”
  • “List the Jinja2 payloads that can read environment variables, and explain each step.”
  • “Suggest blind SSTI detection methods for an endpoint that never shows output.”
Step-by-step guide: how to use Offensive SSTI Testing MethodologyInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-ssti.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-ssti.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-ssti.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use it against targets you are authorized to test, and state the scope in your request so the agent keeps payloads non-destructive.
  • Ask for the engine-fingerprinting decision tree first, then move to exploitation only after confirming server-side execution.
  • Note that the file itself runs no scripts; any real testing will require you to run the payloads or tools yourself against a live target.

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.