[
  {"id":"ssti-adv-001","payload":"{{7*7}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["jinja2","twig","generic"],"notes":"Universal SSTI probe","expected_block":true},
  {"id":"ssti-adv-002","payload":"${7*7}","category":"ssti","method":"GET","severity_hint":"critical","tags":["freemarker","velocity","generic"],"notes":"Dollar-brace SSTI probe","expected_block":true},
  {"id":"ssti-adv-003","payload":"<%= 7*7 %>","category":"ssti","method":"GET","severity_hint":"critical","tags":["erb","jsp","generic"],"notes":"ERB/JSP SSTI probe","expected_block":true},
  {"id":"ssti-adv-004","payload":"#{7*7}","category":"ssti","method":"GET","severity_hint":"critical","tags":["ruby","generic"],"notes":"Ruby interpolation probe","expected_block":true},
  {"id":"ssti-adv-005","payload":"{{config}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["jinja2","flask","info-disclosure"],"notes":"Flask config dump","expected_block":true},
  {"id":"ssti-adv-006","payload":"{{config.__class__.__init__.__globals__['os'].popen('id').read()}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["jinja2","rce","python"],"notes":"Jinja2 RCE via config globals","expected_block":true},
  {"id":"ssti-adv-007","payload":"{{''.__class__.__mro__[2].__subclasses__()}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["jinja2","python","class-chain"],"notes":"Python subclass enumeration","expected_block":true},
  {"id":"ssti-adv-008","payload":"{{''.__class__.__mro__[1].__subclasses__()[396]('id',shell=True,stdout=-1).communicate()}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["jinja2","rce","python","subprocess"],"notes":"Jinja2 subprocess RCE","expected_block":true},
  {"id":"ssti-adv-009","payload":"{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["jinja2","rce","flask"],"notes":"Flask request object RCE","expected_block":true},
  {"id":"ssti-adv-010","payload":"{{cycler.__init__.__globals__.os.popen('id').read()}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["jinja2","rce","cycler"],"notes":"Jinja2 cycler object RCE","expected_block":true},
  {"id":"ssti-adv-011","payload":"{{joiner.__init__.__globals__.os.popen('id').read()}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["jinja2","rce","joiner"],"notes":"Jinja2 joiner object RCE","expected_block":true},
  {"id":"ssti-adv-012","payload":"{{namespace.__init__.__globals__.os.popen('id').read()}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["jinja2","rce","namespace"],"notes":"Jinja2 namespace object RCE","expected_block":true},
  {"id":"ssti-adv-013","payload":"{{lipsum.__globals__['os'].popen('id').read()}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["jinja2","rce","lipsum"],"notes":"Jinja2 lipsum globals RCE","expected_block":true},
  {"id":"ssti-adv-014","payload":"{{self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read()}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["jinja2","rce","self"],"notes":"Jinja2 self reference RCE","expected_block":true},
  {"id":"ssti-adv-015","payload":"{{''|attr('__class__')|attr('__mro__')|attr('__getitem__')(1)|attr('__subclasses__')()|attr('__getitem__')(396)('id',shell=True,stdout=-1)|attr('communicate')()}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["jinja2","rce","attr-filter","evasion"],"notes":"Jinja2 attr filter bypass","expected_block":true},
  {"id":"ssti-adv-016","payload":"{%set cmd='id'%}{{''.__class__.__mro__[1].__subclasses__()[396](cmd,shell=True,stdout=-1).communicate()}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["jinja2","rce","set-tag"],"notes":"Jinja2 set tag variable","expected_block":true},
  {"id":"ssti-adv-017","payload":"{{\"\"[\"\\x5f\\x5fclass\\x5f\\x5f\"]}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["jinja2","evasion","hex"],"notes":"Hex escape __class__","expected_block":true},
  {"id":"ssti-adv-018","payload":"{{7*'7'}}","category":"ssti","method":"GET","severity_hint":"high","tags":["jinja2","twig","fingerprint"],"notes":"Engine fingerprint: Jinja2=7777777, Twig=49","expected_block":true},
  {"id":"ssti-adv-019","payload":"<#assign ex=\"freemarker.template.utility.Execute\"?new()> ${ex(\"id\")}","category":"ssti","method":"GET","severity_hint":"critical","tags":["freemarker","rce","java"],"notes":"FreeMarker Execute class RCE","expected_block":true},
  {"id":"ssti-adv-020","payload":"<#assign classloader=object?api.class.protectionDomain.classLoader><#assign owc=classloader.loadClass(\"freemarker.template.ObjectWrapper\")><#assign dwf=owc.getField(\"DEFAULT_WRAPPER\").get(null)><#assign ec=classloader.loadClass(\"freemarker.template.utility.Execute\")>${dwf.newInstance(ec,null)(\"id\")}","category":"ssti","method":"GET","severity_hint":"critical","tags":["freemarker","rce","classloader"],"notes":"FreeMarker classloader RCE","expected_block":true},
  {"id":"ssti-adv-021","payload":"${\"freemarker.template.utility.Execute\"?new()(\"id\")}","category":"ssti","method":"GET","severity_hint":"critical","tags":["freemarker","rce","short"],"notes":"FreeMarker short RCE","expected_block":true},
  {"id":"ssti-adv-022","payload":"${\"\".getClass().forName(\"java.lang.Runtime\").getRuntime().exec(\"id\")}","category":"ssti","method":"GET","severity_hint":"critical","tags":["velocity","rce","java"],"notes":"Velocity Runtime exec","expected_block":true},
  {"id":"ssti-adv-023","payload":"#set($rt=$\"\".getClass().forName(\"java.lang.Runtime\"))#set($r=$rt.getRuntime())$r.exec(\"id\")","category":"ssti","method":"GET","severity_hint":"critical","tags":["velocity","rce","set"],"notes":"Velocity set directive RCE","expected_block":true},
  {"id":"ssti-adv-024","payload":"*{T(java.lang.Runtime).getRuntime().exec('id')}","category":"ssti","method":"GET","severity_hint":"critical","tags":["thymeleaf","rce","spel"],"notes":"Thymeleaf SpEL RCE","expected_block":true},
  {"id":"ssti-adv-025","payload":"${T(java.lang.Runtime).getRuntime().exec('id')}","category":"ssti","method":"GET","severity_hint":"critical","tags":["spring","spel","rce"],"notes":"Spring Expression Language RCE","expected_block":true},
  {"id":"ssti-adv-026","payload":"${T(java.lang.System).getenv()}","category":"ssti","method":"GET","severity_hint":"critical","tags":["spring","spel","info-disclosure"],"notes":"SpEL environment dump","expected_block":true},
  {"id":"ssti-adv-027","payload":"{{constructor.constructor('return this.process.mainModule.require(\"child_process\").execSync(\"id\")')()}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["pug","rce","node"],"notes":"Pug/Jade template RCE","expected_block":true},
  {"id":"ssti-adv-028","payload":"- var require = global.process.mainModule.require\n= require('child_process').execSync('id')","category":"ssti","method":"GET","severity_hint":"critical","tags":["pug","rce","require"],"notes":"Pug require-based RCE","expected_block":true},
  {"id":"ssti-adv-029","payload":"{{range.constructor(\"return global.process.mainModule.require('child_process').execSync('id')\")()}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["handlebars","rce","node"],"notes":"Handlebars constructor RCE","expected_block":true},
  {"id":"ssti-adv-030","payload":"{{#with \"s\" as |string|}}\n  {{#with \"e\"}}\n    {{#with split as |conslist|}}\n      {{this.pop}}\n      {{this.push (lookup string.sub \"constructor\")}}\n      {{this.pop}}\n      {{#with string.split as |codelist|}}\n        {{this.pop}}\n        {{this.push \"return require('child_process').execSync('id');\"}}\n        {{this.pop}}\n        {{#each conslist}}\n          {{#with (string.sub.apply 0 codelist)}}\n            {{this}}\n          {{/with}}\n        {{/each}}\n      {{/with}}\n    {{/with}}\n  {{/with}}\n{{/with}}","category":"ssti","method":"POST","severity_hint":"critical","tags":["handlebars","rce","prototype"],"notes":"Handlebars prototype pollution RCE","expected_block":true},
  {"id":"ssti-adv-031","payload":"<%- global.process.mainModule.require('child_process').execSync('id') %>","category":"ssti","method":"GET","severity_hint":"critical","tags":["ejs","rce","node"],"notes":"EJS template RCE","expected_block":true},
  {"id":"ssti-adv-032","payload":"<%= `id` %>","category":"ssti","method":"GET","severity_hint":"critical","tags":["erb","rce","ruby"],"notes":"ERB backtick RCE","expected_block":true},
  {"id":"ssti-adv-033","payload":"<%= system('id') %>","category":"ssti","method":"GET","severity_hint":"critical","tags":["erb","rce","ruby"],"notes":"ERB system() RCE","expected_block":true},
  {"id":"ssti-adv-034","payload":"<%= IO.popen('id').read %>","category":"ssti","method":"GET","severity_hint":"critical","tags":["erb","rce","ruby","io"],"notes":"ERB IO.popen RCE","expected_block":true},
  {"id":"ssti-adv-035","payload":"<%= File.read('/etc/passwd') %>","category":"ssti","method":"GET","severity_hint":"critical","tags":["erb","file-read","ruby"],"notes":"ERB file read","expected_block":true},
  {"id":"ssti-adv-036","payload":"{{\"id\" | system}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["liquid","rce"],"notes":"Liquid system filter (if available)","expected_block":true},
  {"id":"ssti-adv-037","payload":"@(1+1)","category":"ssti","method":"GET","severity_hint":"high","tags":["razor","dotnet","probe"],"notes":"Razor syntax probe","expected_block":true},
  {"id":"ssti-adv-038","payload":"@{var p = new System.Diagnostics.Process();p.StartInfo.FileName=\"cmd.exe\";p.StartInfo.Arguments=\"/c id\";p.Start();}","category":"ssti","method":"GET","severity_hint":"critical","tags":["razor","rce","dotnet"],"notes":"Razor Process.Start RCE","expected_block":true},
  {"id":"ssti-adv-039","payload":"{{= 7*7}}","category":"ssti","method":"GET","severity_hint":"high","tags":["dot","probe"],"notes":"doT.js template probe","expected_block":true},
  {"id":"ssti-adv-040","payload":"{{= global.process.mainModule.require('child_process').execSync('id').toString()}}","category":"ssti","method":"GET","severity_hint":"critical","tags":["dot","rce","node"],"notes":"doT.js template RCE","expected_block":true}
]