SSTI-Exploit-Detector

SSTI Exploit Detector is a tool designed to detect potential Server-Side Template Injection (SSTI) vulnerabilities in web applications.

SSTI-Exploit-Detector Jenderal92

Features

• Custom Payload File: Allows users to add their own payloads to test various template engines.
• Default Payloads: Includes pre-built payloads designed to detect vulnerabilities in popular template engines like Jinja2, Tornado, Ruby, and Velocity.
• Automatic Scanning: Automatically sends payloads to the target parameter and examines responses to detect vulnerabilities.

How to Use

1. Download and Install Python

   Ensure Python 2.7 is installed on your system. Download it from the official Python website at: https://www.python.org.

2. Install Required Module

   Run the following command to install the requests library:

   root@kitploit:~

   pip install requests
           

3. Send Payload to Target

   Use the following command to test the target URL with a specific parameter:

   root@kitploit:~

   python ssti_detector.py -u <target_url> -p <parameter_name>
           

   Example:

   root@kitploit:~

   python ssti_detector.py -u http://example.com/login -p username
           

4. Use Custom Payload File

   Add the -f option to use a custom payload file (optional):

   root@kitploit:~

   python ssti_detector.py -u <target_url> -p <parameter_name> -f payloads.txt
           

5. Follow the Results

   Check the logs and results in the terminal to determine if vulnerabilities are found.

Disclaimer !!!

I have written the disclaimer on the cover of Jenderal92. You can check it HERE !!!