How to: SSTI (Server Side Template Injection)
https://www.youtube.com/watch?v=SN6EVIG4c-0
# Template Injections (SSTI) in 10 minutes

https://portswigger.net/research/server-side-template-injection
# Template engines are widely used by web applications to present dynamic data via web pages and emails. Unsafely embedding user input in templates enables Server-Side Template Injection, a frequently critical vulnerability that is extremely easy to mistake for Cross-Site Scripting (XSS), or miss entirely. Unlike XSS, Template Injection can be used to directly attack web servers' internals and often obtain Remote Code Execution (RCE), turning every vulnerable application into a potential pivot point.

https://github.com/epinna/tplmap
# Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operating system.
```tplmap.py --os-shell -u 'http://www.example.com/page?name=John'```

https://github.com/vladko312/SSTImap
# SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself.
```sstimap.py -u https://example.com/page?name=John```

https://github.com/vladko312/Research_Successful_Errors
# This research introduces two such techniques for Code Injection and SSTI: Error-Based and Boolean Error-Based Blind.