PAGES
← all tools
◆ Web Application Security

tinja

1.2.0 open-source

1 more tool, grouped by what they do.

TInjA is a CLI tool that tests web pages for template injection vulnerabilities, supporting 44 template engines across eight programming languages.

source ↗ rss ↗ What is a cyber toolchain?

Summary

tinja is an open-source command-line tool that tests web pages for template injection vulnerabilities, released under the Apache 2.0 licence at no cost. It automatically detects whether template injection is possible and identifies the specific template engine in use, covering 44 engines across eight languages, and distinguishes server-side (SSTISSTIServer-Side Template Injection, a vulnerability class where attacker-controlled input is evaluated by a server-side template engine, enabling remote code execution or data exfiltration.) from client-side (CSTI) issues while using polyglot payloads to keep requests low. It takes crawled URLs in JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. format or a raw HTTP request, supports custom headers, cookies, and query parameters, and can route traffic through a proxy such as Burp Suite, which suits penetration testers and application security engineers doing manual or semi-automated web assessments. First committed in 2023 and built by Hackmanit, it has had 5 contributors and 6 releases in the tracked window, though the most recent release was 470 days ago and only 4 commits have landed in the past year.

TInjA is a CLI tool that tests web pages for template injection vulnerabilities, supporting 44 template engines across eight programming languages.

How tinja helps

Which template engine is rendering this page, and could that shape my exploit?

matches the response behaviour against its library of 44 engines across eight languages and names the specific engine and language in use

Is this injection happening in the browser or on the server?

classifies each finding as server-side or client-side based on where the payload is evaluated, so the two are never conflated

Can I sweep every URL my crawler found without hammering the target?

accepts a JSONL list of crawled URLs and tests each one, using polyglot payloads that average five requests per page before a verdict is reached

Can I test a request that needs a session cookie or a custom header to even reach the vulnerable code?

takes a raw HTTP request or lets you set custom headers, cookies, and query or POST parameters so the scan reaches the same code path a browser would

Can I watch these requests happen in Burp instead of trusting the tool's own output?

routes all traffic through a configured proxy such as Burp Suite so every payload and response can be inspected as it happens

all 5 features, with the evidence for each →

Languages

Not documented

Features

5 capabilities · 2 backed by code, an API document or a real run

Built from tinja's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • tinja covers 1 of the 8 vulnerability assessment methods capabilities we track.

What tinja offers you

  • Command-line interface1
Web vulnerability scanning 5 features Vulnerability assessment methods since 2024
Raw file input for crawl results verified Accepts a pre-collected raw crawl results file as input instead of performing a live crawl. 1 release · 4 other sources · first seen Jan 2024

Shared capability: Web vulnerability scanning

Also counts toward: Command-line interface

release

  • Adds tinja raw subcommand to read and scan from raw HTTP request file paths via the -R flag. 1.1.0 · Jan 2024 · source · release history

command line

example

  • Scan a previously saved HTTP request for template injection vulnerabilities using the new raw import capability. tinja raw -R "/path/to/request.txt" 1.1.0 · Jan 2024 · source
  • Scan URL from raw HTTP request file tinja raw -R "/path/to/file"
Header injection testing verified Tests specified HTTP headers (such as Host, Origin, and X-Forwarded-For) for injection and manipulation vulnerabilities. 1 release · 2 other sources · first seen Mar 2024

Shared capability: Web vulnerability scanning

release

  • Adds --testheaders CLI flag to specify comma-separated header names for template injection testing 1.1.2 · Mar 2024 · source · release history

command line

  • --testheaders — headers to test. E.g. --testheaders Host,Origin,X-Forwarded-For 1.1.2 · Mar 2024 · command-line history

example

  • Scan HTTP headers for template injection vulnerabilities by specifying which headers to test tinja --testheaders Host,Origin,X-Forwarded-For http://target.com/page 1.1.2 · Mar 2024 · source
Template engine identification shipped Detects specific template engines, such as handlebars with context, during server-side template injection scanning. 1 release · first seen May 2025

Shared capability: Web vulnerability scanning

release

  • Detects handlebars with context as a supported template engine during SSTI scanning. 1.2.0 · May 2025 · source · release history
False positive reduction shipped Sends a tailored verification request after initial detection to reduce false positives in template injection scanning. 1 release · first seen Jan 2024

Shared capability: Web vulnerability scanning

release

  • Adds a hybrid approach for template injection: sends a tailored verification request after initial detection to reduce false positives. 1.1.0 · Jan 2024 · source · release history
Client-side template injection scanning shipped Scans web pages for client-side template injection (CSTI) vulnerabilities in addition to server-side injection. 1 other source

Shared capability: Web vulnerability scanning

example

  • Scan for CSTI in addition to SSTI tinja url -u "http://example.com/" --csti

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for tinja, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail tinja puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

3 entries

  1. May 20251
  3. March 20241
  5. January 20241

    3 entries

    1. 1.2.0 May 8, 2025 · release notes

      TInjA 1.2.0 adds Handlebars-with-context template engine detection to its SSTISSTIServer-Side Template Injection, a vulnerability class where attacker-controlled input is evaluated by a server-side template engine, enabling remote code execution or data exfiltration. scanner.

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.2.0 https://github.com/Hackmanit/TInjA.git
# already have the repo? check out this version:
$ git checkout 1.2.0
      • Detects handlebars with context as a supported template engine during SSTI scanning.

      1 detail in Everything

    2. 1.1.2 Mar 3, 2024 · release notes

      TInjA 1.1.2 adds --testheaders flag to test template injection in specified HTTP headers

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.1.2 https://github.com/Hackmanit/TInjA.git
# already have the repo? check out this version:
$ git checkout 1.1.2
      └──▷ USE IT
      Scan HTTP headers for template injection vulnerabilities by specifying which headers to test
      shell 
      tinja --testheaders Host,Origin,X-Forwarded-For http://target.com/page
      • Adds --testheaders CLI flag to specify comma-separated header names for template injection testing
      • Updates dependencies

      2 details in Everything

    3. 1.1.0 Jan 2, 2024 · release notes

      TInjA 1.1.0 adds hybrid template injection scanning with verification requests and tinja raw command for importing HTTP request files.

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.1.0 https://github.com/Hackmanit/TInjA.git
# already have the repo? check out this version:
$ git checkout 1.1.0
      └──▷ TRY IT
      Scan a previously saved HTTP request for template injection vulnerabilities using the new raw import capability.
      $ tinja raw -R "/path/to/request.txt"
      • Adds a hybrid approach for template injection: sends a tailored verification request after initial detection to reduce false positives.
      • Adds tinja raw subcommand to read and scan from raw HTTP request file paths via the -R flag.

      2 details in Everything

    Project health

    Issue, contributor and maintainer activity in Hackmanit/TInjA, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 ±0 vs prior 12 months
    2. Maintainers 1 +0 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 2 of 8 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 2
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 426
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback