SSTI Bug Bounty Hunting: Detect Server-Side Template Injection
Server-side template injection means your input is evaluated as a template expression, not rendered as text. On many engines that path leads to RCE. On others you get information leaks first.
The skill is detection and engine identification before you reach for a reverse shell payload.
Detection that avoids false positives
Client-side frameworks also use {{ }}. Seeing braces echo back is not SSTI.
Better initial probes:
- Arithmetic that only a template engine would evaluate:
{{7*7}}→49 - Engine-specific probes once arithmetic works (
{{config}},49,<%= 7*7 %>, FreeMarker#{7*7}, etc.)
Compare responses carefully. Some apps strip braces, some encode them, some evaluate them in email subjects or PDF renders only — “blind SSTI.”
Common sinks
- Error pages that embed user input into a server template
- Email / invoice / PDF generators
- Personalization features (“hello ${name}”)
- CMS themes that let moderators edit templates (sometimes intended — check whether code exec is in scope)
From read to impact
- Confirm evaluation with math.
- Identify the engine via error messages or distinct objects.
- Attempt a read-only proof: list a harmless property, read an env var the program allows, or trigger a time delay.
- Escalate to command execution only if in scope and using a safe canary (DNS callback,
sleep, unique file).
PortSwigger’s SSTI material and OWASP references help map engines to gadgets; still verify versions. A Twig sandbox may block what raw Twig allows.
Blind SSTI
No reflection? Use out-of-band expressions or timing. Document the channel. Blind does not mean unprovable.
Report quality bar
Include the parameter, the math proof, engine guess, and the highest safe impact you demonstrated. If you stopped at config disclosure, say why (sandbox, scope). Attach raw requests.
Do not paste a 40-line RCE chain as your first interaction with a production host.
Closing thought for hunters
SSTI rewards methodical engine ID over meme payloads. Get 49 to print, learn which template dialect you are speaking, then climb the capability ladder one controlled step at a time — that is how SSTI reports sail through triage.