Marven11/Fenjing

Health v2 · maintenance only

Adoption not part of the score

1301 stars · 74 forks observed · 2026-09-03

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Fenjing is an automated Jinja2 SSTI (server-side template injection) exploitation tool designed for CTF competitions. It automatically analyzes a target website's WAF, generates bypassing payloads, and attacks given URLs, HTML forms, or raw HTTP requests.

Use cases

• bypass WAF filters in Jinja2 SSTI challenges
• automatically fuzz and attack CTF web challenge parameters
• generate SSTI payloads from a keyword blacklist in source code
• scan a URL for exploitable template injection points
• crack SSTI via raw HTTP request files or JSON APIs

When to choose

• solving CTF web challenges involving Jinja2 template injection
• you need automated WAF detection and payload generation instead of manual fuzzing
• you want a CLI or web UI to drive SSTI exploitation

When to avoid

• production penetration testing where SSTI exploitation may be out of scope or illegal
• template engines other than Jinja2
• you need a general-purpose web vulnerability scanner

Facets

cli-tool · maturity active

penetration-testing security cli web-scraping security penetration-testing developer-tools python cli cross-platform ssti jinja2 waf-bypass ctf exploit-tool webui docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Marven11/Fenjing")