1 INTRODUCTION  
2 TEMPLATE ENGINES AND SSTI IN THE WILD  
2.1 Template Engines Usage  
2.2 Real World Examples of SSTI  
2.3 SSTI Related CVEs  
2.4 SSTI Scenarios  
3 TEMPLATE ENGINES AND SERVER-SIDE TEMPLATE INJECTION  
3.1 Overview of Template Engines  
3.2 Why is RCE Often Allowed?  
3.3 RCE Example  
3.4 Types of SSTI  
4 SEMINAL WORKS ON SSTI  
4.1 Exploitation Methodology  
4.2 Protecting Against SSTI With Instruction Set Randomization  
5 SSTI DETECTION TOOLS  
5.1 Tplmap  
5.2 ZAP-Esup  
6 REMOTE CODE EXECUTION IN TEMPLATE ENGINES  
6.1 RCE Types in Template Engines  
6.2 Preventing RCE  
6.3 Escaping the Sandbox  
7 TEMPLATE ENGINE ANALYSIS  
7.1 Programming Languages  
7.2 Analysis Results  
8 MEANINGFUL EXAMPLES  
8.1 Pyratemp: the Python Sandbox  
8.2 Smarty: a PHP Sandbox  
8.3 Dust: When Bugs Allow RCE  
8.4 Jinjava: Java Introspection to RCE  
8.5 ERB: Ruby Code Execution  
9 CONCLUSIONS