<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Server Side Template Injection

## tplmap — SSTI Exploitation
```bash
tplmap -u "URL?name=test"
tplmap -u "URL?name=test" --os-shell
tplmap -u "URL?name=test" --os-cmd "id"
```

## curl — SSTI Detection
```bash
# Jinja2/Twig detection
curl -s "URL?name={{7*7}}"

# Freemarker/Velocity detection
curl -s "URL?name=${7*7}"

# ERB detection
curl -s "URL?name=<%= 7*7 %>"
```

## semgrep — Template Sink Analysis
```bash
semgrep --config=p/owasp-top-ten src/ | grep -i template
rg "render_template_string|from_string\(" src/
```
