Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-inpv-18
Testing for Server-Side Template Injection (SSTI)
Passed 16 of 21 test cases with the skill, and 11 of 21 without it.
and 3 more in the full report
6 fixed11 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
Which OWASP Web Security Testing Guide (WSTG) test identifier specifically corresponds to 'Testing for Server-Side Template Injection'?
| Checked | Without skill | With skill |
|---|---|---|
| The test identifier is WSTG-INPV-18. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-INPV-18
Testing for Server-Side Template Injection (SSTI)
Server-Side Template Injection occurs when user input is embedded in templates in an unsafe manner. Attackers can inject template directives to execute arbitrary code on the server, read files, or access sensitive data. This affects frameworks like Jinja2, Twig, Freemarker, Velocity, and others.
#!/bin/bash
TARGET="https://target.com/page"
echo "[*] Testing for SSTI..."
# Universal detection payloads
PAYLOADS=(
"{{7*7}}"
test cases passed, vs 11 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.