sstimap

name: sstimap description: "Auth/lab ref: actively maintained SSTI detection and exploitation tool with interactive and predetermined modes across Jinja2, Twig, Smarty, Freemarker, Velocity, ERB, Pug, Nunjucks, and more." license: GPL-3.0 compatibility: "Linux / macOS / Windows; Python 3." metadata: author: AeonDave version: "1.0"

SSTImap

Modern SSTI detection and exploitation — maintained successor to tplmap.

Quick Start

git clone https://github.com/vladko312/SSTImap
cd SSTImap && pip3 install -r requirements.txt

# Basic detection
python3 sstimap.py -u "http://target.com/render?name=*"

# POST injection point
python3 sstimap.py -u "http://target.com/render" -d "name=*"

# Interactive exploitation
python3 sstimap.py -u "http://target.com/render?name=*" --interactive

Use * to mark the injection point in URL params, POST body, or headers.

Core Flags

Supported Engines

Common engines covered:

• Jinja2 / Python eval
• Twig / Smarty
• Freemarker / Velocity
• ERB / Slim / Ruby eval
• Pug / Nunjucks / doT / Dust / EJS
• Tornado / Mako / Marko

Detection Workflow

# 1. Confirm reflection manually
name={{7*7}}
name=${7*7}
name=<%= 7*7 %>
name=#{7*7}

# 2. Hand off to SSTImap
python3 sstimap.py -u "http://target.com/?name=*"

# 3. If engine known, force it for cleaner exploitation
python3 sstimap.py -u "http://target.com/?name=*" --engine jinja2 --interactive

Typical Escalation Path

Why Prefer SSTImap over tplmap

• Actively maintained with releases in 2025
• Native Python 3 workflow
• Interactive mode is cleaner for real exploitation
• Extra plugins support newer engines and CVE-specific chains

References

• SSTI payloads: references/ssti-payloads.md
• SSTImap repository