vladko312/SSTImap

Health v2 · maintenance only

Adoption not part of the score

1621 stars · 186 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

SSTImap is a Python-based penetration testing tool that automatically detects and exploits Server-Side Template Injection (SSTI) and code injection vulnerabilities in web applications. It is an actively maintained fork of Tplmap with an interactive exploitation mode, additional detection techniques, and support for template engines across Java, JavaScript, PHP, Python, and Ruby.

Use cases

• detect server-side template injection vulnerabilities in a website
• exploit SSTI to get remote code execution during a pentest
• run shell commands through an eval-like code injection
• test web forms and parameters for template injection
• identify which template engine a web app uses
• perform blind SSTI detection and file upload exploitation

When to choose

• you are doing authorized penetration testing of web applications for SSTI/RCE
• you want an interactive shell for exploiting template injection
• you need broad template engine coverage including blind injection scenarios
• you want a maintained Python 3 alternative to Tplmap

When to avoid

• you need a Burp Suite extension (currently removed)
• you require Tplmap backwards-compatible command-line arguments
• you are looking for a general web vulnerability scanner beyond SSTI/code injection
• you cannot legally test the target system

Facets

cli-tool · maturity active

penetration-testing security web-scraping security penetration-testing web-development python cli cross-platform ssti template-injection rce exploitation pentest-tool tplmap-fork interactive-shell

Member repositories

For agents

markdown · JSON · MCP: product_card(name="vladko312/SSTImap")