131  sstimap(1) - Kailash Tool Reference

131.1 sstimap

sstimap - SSTI detection and exploitation assistant (Server-Side Template Injection).

Layer CLASSIC
Category c-03-web-application-assessment
Safety class safe
Licence GPL-3.0-only
Upstream github.com/vladko312/SSTImap

131.1.1 NAME

sstimap - SSTI detection and exploitation assistant (Server-Side Template Injection).

131.1.2 SYNOPSIS & usage

Derived from the upstream README at generation time; verify against --help where the tool is installed.

$ curl -g 'https://www.target.com/page?name=John'
Hello John!<br>
OS type: posix
$ curl -g 'https://www.target.com/page?name={{7*7}}'
Hello 49!<br>
OS type: posix

131.1.3 DESCRIPTION (upstream)

SSTImap ====== > This project is based on Tplmap. SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to be used as an interactive penetration testing tool for SSTI detection and exploitation, which allows more advanced exploitation. More payloads for SSTImap can be found here. Payloads and techniques came from: - James Kettle’s [Server-Side Template Injection: RCE For The Modern Web App][5] - Other public researches [[1]][1] [[2]][2] [[8]][8

131.1.4 SEE ALSO

ref: pin - verified 2026-10-14