I recently found a blind FreeMarker SSTI on a bbp. It was not possible to RCE but I found some nice gadgets to enumerate accessible variables, read data blindly or perform some DoS. I documented that here if someone is interested
gist.github.com/n1nj4sec/5e3...
gist.github.com/n1nj4sec/5e3...
FreeMarker SSTI tricks
FreeMarker SSTI tricks. GitHub Gist: instantly share code, notes, and snippets.
gist.github.com
December 18, 2024 at 8:13 PM
I recently found a blind FreeMarker SSTI on a bbp. It was not possible to RCE but I found some nice gadgets to enumerate accessible variables, read data blindly or perform some DoS. I documented that here if someone is interested
gist.github.com/n1nj4sec/5e3...
gist.github.com/n1nj4sec/5e3...
We broke something:
in a recent pentest on a hardened target, we were able to achieve unauthenticated Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) in a Spring Boot application
We wrote it down for you to try at home:
modzero.com/en/blog/spri...
in a recent pentest on a hardened target, we were able to achieve unauthenticated Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) in a Spring Boot application
We wrote it down for you to try at home:
modzero.com/en/blog/spri...
Exploiting SSTI in a Modern Spring Boot Application (3.3.4)
modzero.com
January 10, 2025 at 9:51 AM
We broke something:
in a recent pentest on a hardened target, we were able to achieve unauthenticated Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) in a Spring Boot application
We wrote it down for you to try at home:
modzero.com/en/blog/spri...
in a recent pentest on a hardened target, we were able to achieve unauthenticated Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) in a Spring Boot application
We wrote it down for you to try at home:
modzero.com/en/blog/spri...
300 lines of Python that fuzzes web templates for SSTI and flags vulnerable engines. Advanced. Run: python3 ssti_tester.py --url URL
https://www.valtersit.com/python/server-side-template-injection-ssti-tester/
#security #python #appsec
https://www.valtersit.com/python/server-side-template-injection-ssti-tester/
#security #python #appsec
Server-Side Template Injection (SSTI) Tester
www.valtersit.com
September 27, 2026 at 4:00 AM
300 lines of Python that fuzzes web templates for SSTI and flags vulnerable engines. Advanced. Run: python3 ssti_tester.py --url URL
https://www.valtersit.com/python/server-side-template-injection-ssti-tester/
#security #python #appsec
https://www.valtersit.com/python/server-side-template-injection-ssti-tester/
#security #python #appsec
anyways Joel’s abdominal wound isn’t just an SSTI, he needs anaerobic and gram-negative coverage. Augmentin maybe.
January 10, 2026 at 5:01 AM
anyways Joel’s abdominal wound isn’t just an SSTI, he needs anaerobic and gram-negative coverage. Augmentin maybe.
Salah satu momen ssti 🤣🤣🤣
October 20, 2024 at 1:09 PM
Salah satu momen ssti 🤣🤣🤣
SSTI is here!
SSTI is helping shape our transportation system to be more sustainable, equitable, safe, and efficient.
We share the latest research, highlight innovative practices from state DOTs, and connect transportation professionals across the country to exchange solutions.
Stay up to date: ssti.us/blog/
We share the latest research, highlight innovative practices from state DOTs, and connect transportation professionals across the country to exchange solutions.
Stay up to date: ssti.us/blog/
February 7, 2025 at 4:39 PM
SSTI is here!
Hadn't checked in on SSTI's stock in a while... down almost 81% from when Brandon Johnson was elected mayor.
May 29, 2026 at 3:35 PM
Hadn't checked in on SSTI's stock in a while... down almost 81% from when Brandon Johnson was elected mayor.
Congrats to my colleagues for this interesting analysis.
Looking at patients who met DOTS criteria and receive dalbavancin in our hospital, they differ from the DOTS trial
Younger, more IDU, more R-sided IE (less SSTI), and more persistent bacteremia.
Yet, outcomes similar #IDSky
Looking at patients who met DOTS criteria and receive dalbavancin in our hospital, they differ from the DOTS trial
Younger, more IDU, more R-sided IE (less SSTI), and more persistent bacteremia.
Yet, outcomes similar #IDSky
In clinical practice, patients with #Bacteremia receiving dalbavancin were younger and more likely to have substance use or housing instability than those in the DOTS trial, but completed therapy with similar low failure rates. ja.ma/4odctAk
June 4, 2026 at 5:38 PM
Congrats to my colleagues for this interesting analysis.
Looking at patients who met DOTS criteria and receive dalbavancin in our hospital, they differ from the DOTS trial
Younger, more IDU, more R-sided IE (less SSTI), and more persistent bacteremia.
Yet, outcomes similar #IDSky
Looking at patients who met DOTS criteria and receive dalbavancin in our hospital, they differ from the DOTS trial
Younger, more IDU, more R-sided IE (less SSTI), and more persistent bacteremia.
Yet, outcomes similar #IDSky
And that SSTI's stock has never rebounded from the day Johnson won the election.
August 7, 2025 at 2:43 PM
And that SSTI's stock has never rebounded from the day Johnson won the election.
TIL: A new bacterial genus - Myroides
Case series from @ofidjournal.bsky.social
#IDSky
academic.oup.com/ofid/advance...
Case series from @ofidjournal.bsky.social
#IDSky
academic.oup.com/ofid/advance...
Clinical Features and Outcomes of Myroides Species Infections
Between 2015 and 2023, 21 clinically significant Myroides infections were identified at Cleveland Clinic. Infections included osteomyelitis, UTIs, and SSTI
academic.oup.com
January 29, 2025 at 11:11 PM
TIL: A new bacterial genus - Myroides
Case series from @ofidjournal.bsky.social
#IDSky
academic.oup.com/ofid/advance...
Case series from @ofidjournal.bsky.social
#IDSky
academic.oup.com/ofid/advance...
That feeling when something you see every day is presented as an "insight" arising from "new research"
"People cross the street where it makes sense."
SSTI (@innovativedot.bsky.social) does great work, but I wonder if this framing makes academics sound as if they never go outside. 1/
"People cross the street where it makes sense."
SSTI (@innovativedot.bsky.social) does great work, but I wonder if this framing makes academics sound as if they never go outside. 1/
April 28, 2026 at 4:46 PM
That feeling when something you see every day is presented as an "insight" arising from "new research"
"People cross the street where it makes sense."
SSTI (@innovativedot.bsky.social) does great work, but I wonder if this framing makes academics sound as if they never go outside. 1/
"People cross the street where it makes sense."
SSTI (@innovativedot.bsky.social) does great work, but I wonder if this framing makes academics sound as if they never go outside. 1/
🎮 "Ça redémarre": portée par plusieurs succès français à l'international, la Paris Games Week, plus important salon du jeu vidéo en France, revient mercredi soir dans un nouveau format et fête une industrie qui retrouve le moral.
➡️ u.afp.com/Ssti
➡️ u.afp.com/Ssti
October 27, 2025 at 4:31 PM
🎮 "Ça redémarre": portée par plusieurs succès français à l'international, la Paris Games Week, plus important salon du jeu vidéo en France, revient mercredi soir dans un nouveau format et fête une industrie qui retrouve le moral.
➡️ u.afp.com/Ssti
➡️ u.afp.com/Ssti
Pretty grim ODOT budget breakdown by State Smart Transportation Initiative (SSTI)
ODOT's spending way more on expanding than maintaining roads
state funding overwhelmingly (86%/14%) geared towards roads instead of transit
traffic fatalities higher than nat'l average #orleg
ssti.us/wp-content/u...
ODOT's spending way more on expanding than maintaining roads
state funding overwhelmingly (86%/14%) geared towards roads instead of transit
traffic fatalities higher than nat'l average #orleg
ssti.us/wp-content/u...
April 16, 2025 at 9:18 PM
Pretty grim ODOT budget breakdown by State Smart Transportation Initiative (SSTI)
ODOT's spending way more on expanding than maintaining roads
state funding overwhelmingly (86%/14%) geared towards roads instead of transit
traffic fatalities higher than nat'l average #orleg
ssti.us/wp-content/u...
ODOT's spending way more on expanding than maintaining roads
state funding overwhelmingly (86%/14%) geared towards roads instead of transit
traffic fatalities higher than nat'l average #orleg
ssti.us/wp-content/u...
Ronin vulns: A Ruby library that tests URLs for Local File Inclusion (LFI), Remote File Inclusion (RFI), SQL injection (SQLi), and Cross Site Scripting (XSS), Server Side Template Injection (SSTI), and Open Redirects.
github.com/ronin-rb/ron...
#infosec
#cybersecurity
#threatdetection
#xss #SQLi
github.com/ronin-rb/ron...
#infosec
#cybersecurity
#threatdetection
#xss #SQLi
GitHub - ronin-rb/ronin-vulns: Tests URLs for Local File Inclusion (LFI), Remote File Inclusion (RFI), SQL injection (SQLi), and Cross Site Scripting (XSS), Server Side Template Injection (SSTI), an...
Tests URLs for Local File Inclusion (LFI), Remote File Inclusion (RFI), SQL injection (SQLi), and Cross Site Scripting (XSS), Server Side Template Injection (SSTI), and Open Redirects. - ronin-rb...
github.com
November 19, 2024 at 3:53 AM
Ronin vulns: A Ruby library that tests URLs for Local File Inclusion (LFI), Remote File Inclusion (RFI), SQL injection (SQLi), and Cross Site Scripting (XSS), Server Side Template Injection (SSTI), and Open Redirects.
github.com/ronin-rb/ron...
#infosec
#cybersecurity
#threatdetection
#xss #SQLi
github.com/ronin-rb/ron...
#infosec
#cybersecurity
#threatdetection
#xss #SQLi
#idsky #shorterisbetter outpatient oncology pts w/uncomplicated infections treated for 7d vs 14d for UTI, SSTI and LRTI showed no worse outcomes with shorter duration #idmeded #meded
Is shorter better in oncology patients, too? A retrospective cohort study of short- versus long-course antibiotic therapy for uncomplicated infections in solid tumor patients receiving care in ambulatory oncology clinics
✅ Just Accepted
#IDSky
✅ Just Accepted
#IDSky
Is shorter better in oncology patients, too? A retrospective cohort study of short- versus long-course antibiotic therapy for uncomplicated infections in solid tumor patients receiving care
This retrospective cohort study evaluated short- vs. long-course antibiotics for uncomplicated infections in ambulatory solid tumor patients.
bit.ly
August 28, 2025 at 6:56 PM
#idsky #shorterisbetter outpatient oncology pts w/uncomplicated infections treated for 7d vs 14d for UTI, SSTI and LRTI showed no worse outcomes with shorter duration #idmeded #meded
#OTILT Doxycycline is added in Vibrio vulnifucus infections, as protein synthesis inhibition can counter MARTX toxin production. In a case report, a patient was initially treated for GAS SSTI. Doxycycline was added 4-5h later, following brackish water exposure reports, but within 48h, he died.
September 24, 2026 at 7:09 PM
#OTILT Doxycycline is added in Vibrio vulnifucus infections, as protein synthesis inhibition can counter MARTX toxin production. In a case report, a patient was initially treated for GAS SSTI. Doxycycline was added 4-5h later, following brackish water exposure reports, but within 48h, he died.
Final semiconductor R&D facility location among latest CHIPS for America awards | SSTI
ssti.org
January 9, 2025 at 4:56 PM
We don’t need to overthink induced demand to do something about it.
"Build for cars, and you’ll get more driving; build for transit or biking, and you’ll get more of those too."
Read my latest piece from SSTI.
"Build for cars, and you’ll get more driving; build for transit or biking, and you’ll get more of those too."
Read my latest piece from SSTI.
We don’t need to overthink induced demand to act on it
The concept of induced demand is now widely recognized in transportation. But we often treat it as a technical modeling issue rather than a basic principle of how people respond to the world around th...
ssti.us
December 9, 2025 at 9:58 PM
We don’t need to overthink induced demand to do something about it.
"Build for cars, and you’ll get more driving; build for transit or biking, and you’ll get more of those too."
Read my latest piece from SSTI.
"Build for cars, and you’ll get more driving; build for transit or biking, and you’ll get more of those too."
Read my latest piece from SSTI.
I wrote a blog post about SSTI in Thymelaf - hopefully it helps some people pentesting up-to-date Spring Boot applications :)
We broke something:
in a recent pentest on a hardened target, we were able to achieve unauthenticated Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) in a Spring Boot application
We wrote it down for you to try at home:
modzero.com/en/blog/spri...
in a recent pentest on a hardened target, we were able to achieve unauthenticated Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) in a Spring Boot application
We wrote it down for you to try at home:
modzero.com/en/blog/spri...
Exploiting SSTI in a Modern Spring Boot Application (3.3.4)
modzero.com
January 11, 2025 at 11:47 AM
I wrote a blog post about SSTI in Thymelaf - hopefully it helps some people pentesting up-to-date Spring Boot applications :)
Antibiotic durations for uncomplicated SSTI often exceed the guideline-recommended 5-7 days!
🆕️✨️Cluster Randomized Trial
Default Antibiotic Order Durations for Skin and Soft Tissue Infections in Outpatient Pediatrics #idsky #pedsky
academic.oup.com/jpids/advanc...
🆕️✨️Cluster Randomized Trial
Default Antibiotic Order Durations for Skin and Soft Tissue Infections in Outpatient Pediatrics #idsky #pedsky
academic.oup.com/jpids/advanc...
Default Antibiotic Order Durations for Skin and Soft Tissue Infections in Outpatient Pediatrics: A Cluster Randomized Trial
AbstractBackground. Antibiotic durations for uncomplicated skin/soft tissue infections (SSTI) often exceed the guideline-recommended 5-7 days. We assessed
academic.oup.com
December 14, 2024 at 9:01 PM
Antibiotic durations for uncomplicated SSTI often exceed the guideline-recommended 5-7 days!
🆕️✨️Cluster Randomized Trial
Default Antibiotic Order Durations for Skin and Soft Tissue Infections in Outpatient Pediatrics #idsky #pedsky
academic.oup.com/jpids/advanc...
🆕️✨️Cluster Randomized Trial
Default Antibiotic Order Durations for Skin and Soft Tissue Infections in Outpatient Pediatrics #idsky #pedsky
academic.oup.com/jpids/advanc...
💡 A: The first step when evaluating a patient with SSTI is to assess for purulence, which can be manifested as “lumps, bumps, or pus.”
Empiric MRSA coverage is indicated for purulent SSTI, not non-purulent SSTI.
Empiric MRSA coverage is indicated for purulent SSTI, not non-purulent SSTI.
October 8, 2025 at 2:07 PM
💡 A: The first step when evaluating a patient with SSTI is to assess for purulence, which can be manifested as “lumps, bumps, or pus.”
Empiric MRSA coverage is indicated for purulent SSTI, not non-purulent SSTI.
Empiric MRSA coverage is indicated for purulent SSTI, not non-purulent SSTI.
I let Burp AI loose against a couple more web challenges over on Portswigger Web Academy: SSRF & SSTI
Watch how it does: youtu.be/eQBD2-k9V7s
Watch how it does: youtu.be/eQBD2-k9V7s
November 19, 2025 at 3:01 PM
I let Burp AI loose against a couple more web challenges over on Portswigger Web Academy: SSRF & SSTI
Watch how it does: youtu.be/eQBD2-k9V7s
Watch how it does: youtu.be/eQBD2-k9V7s