https://cybertoolchain.io/tools/sstimap New releases and features in sstimap, tracked by The Cyber Toolchain. en Tue, 25 Aug 2026 23:06:40 GMT https://github.com/vladko312/SSTImap/releases/tag/v1.4 https://github.com/vladko312/SSTImap/releases/tag/v1.4 Tue, 25 Aug 2026 23:06:40 GMT SSTImap v1.4 adds save/load of detected vulnerabilities, Pybars3/4 and Mustache GHSA-5hrj-7fc3-cmx9 plugins, and header/cookie-aware crawling. • Adds ability to save detected vulnerabilities to file and reload them in a later session. • New plugin detects GHSA-5hrj-7fc3-cmx9 in Mustache template engine. • New plugin supports Pybars3 and Pybars4 template engines for detection and exploitation. • New plugin for fuzzing uncommon and legacy evaluating template injection patterns. • Crawling and form detection now respect user-supplied headers and cookies, enabling authenticated crawl sessions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sstimap https://github.com/vladko312/SSTImap/releases/tag/v1.3 https://github.com/vladko312/SSTImap/releases/tag/v1.3 Tue, 19 Aug 2025 22:44:19 GMT SSTImap v1.3 adds error-based and boolean blind detection techniques, Spring EL injection plugin, and new engine capabilities. • Adds error-based detection and exploitation technique for SSTI scanning. • Adds boolean error-based blind detection and exploitation technique. • Enables ordered technique testing — techniques are now tested in the user-specified order. • New plugin for Spring EL injection detection and exploitation. • Supports `fromfile` data type to supply request body parts from files. • Freemarker engine now supports expression evaluation. • Dust.js now supports rendered code execution. • Adds Base64 exfiltration support (available for plugin use). • Context suffix can now include closure or reversed closure. • Plugins can now specify header and trailer length for more precise injection control. • SSTImap can now run with form detection disabled when optional dependencies are not installed. • Twig CVE payload replaced with |map()-based payload (CVE payload moved to Extras). • Generic template engines are now skipped by default in favor of generic plugins. Breaking changes: • Generic template engines are now skipped by default; setups relying on generic template engine detection without explicitly enabling them may no longer test those engines. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sstimap https://github.com/vladko312/SSTImap/releases/tag/v1.2 https://github.com/vladko312/SSTImap/releases/tag/v1.2 Sat, 06 Jan 2024 22:54:43 GMT Adds `--req-body-type` for multi-format payloads and `--shell` to specify target shell in SSTImap v1.2 • Adds `--req-body-type` flag (json, text, fromhex) to handle non-URLencoded request bodies • Adds `--shell` argument to specify the expected target system shell Breaking changes: • The original Twig payload is now renamed to `Twig_v1`; scripts referencing the previous default Twig payload name will fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sstimap https://github.com/vladko312/SSTImap/releases/tag/v1.1 https://github.com/vladko312/SSTImap/releases/tag/v1.1 Sun, 16 Apr 2023 22:40:19 GMT v1.1 adds Cheetah template engine, Python 3.11 support, crawler/form detection, and interactive reloading • `--engine cheetah` selects the new Cheetah template engine for payload generation. • Enables `interactive` mode with module reloading via a new REPL command, allowing live updates without restarting the scan. Breaking changes: • Removed dependency on `telnetlib`; requires Python 3.11+ or manual installation of replacement TCP client. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sstimap