epinna/tplmap
Tplmap
tplmap is a security tool designed for the detection and exploitation of server-side template injection vulnerabilities. It functions as an automated scanner to identify vulnerable template engine contexts and provides a framework for achieving remote code execution.
The tool focuses on translating high-level requests into engine-specific syntax to execute operating system commands and bypass application sandboxes. It further enables remote file system access, allowing users to read, write, and transfer files between a local machine and a target server.
Additional capabilities include the ability to launch local vulnerable servers to simulate flawed environments for payload verification. The project also supports integration with web security proxies to automate the injection of test payloads into intercepted traffic.
Features
- Server-Side Template Injection Detection - Automates the detection and exploitation of server-side template injection vulnerabilities.
- Shell Command Execution - Executes arbitrary operating system shell commands by bypassing application sandboxes.
- Engine-Specific Templates - Generates targeted injection strings based on the identified template engine to bypass security filters.
- Remote Code Execution Tools - Provides a framework to achieve and manage arbitrary code execution via template injection.
- Remote Access Payloads - Translates high-level requests into engine-specific syntax to execute operating system commands on target servers.
- Injection Mapping - Identifies vulnerable engines by sending polyglot payloads and analyzing server response patterns.
- Web Application Penetration Testing - Automates the discovery of injection flaws in web servers during active security assessments.
- Remote File Transfers - Facilitates moving files between local and remote systems by leveraging template engine primitives.
- Remote File Read-Write Operations - Provides the ability to read and write files on a remote server via template injection.
- Bidirectional Host-to-Server File Transfers - Moves files bidirectionally between local machines and remote servers using active injection points.
- Vulnerable Server Simulations - Launches containerized web servers running flawed template engines to validate exploit payloads.
- Vulnerable Scenario Deployments - Deploys intentionally misconfigured local web servers to verify tool functionality.
- File System Access Controls - Leverages template engine flaws to read sensitive data from or write files to the target file system.
- Vulnerability Simulations - Simulates vulnerable template engine environments for practicing exploitation techniques.
- Vulnerability Scanners - SSTI and code injection detection tool.
- Command and Template Injection - Detects and exploits server-side template and code injection.
- Fuzzing and Injection - Detects and exploits code and server-side template injections.
- Specialized Vulnerability Scanners - Tool for detecting and exploiting server-side template injection vulnerabilities.
- SSTI Injection - Tool for detecting and exploiting SSTI and code injection.
- Template Injection Tools - Automated tool for exploiting code and template injection vulnerabilities.
- Vulnerability Exploitation Frameworks - Detects and exploits server-side template injection.
- Web Exploitation - Exploits Server-Side Template Injection vulnerabilities.
- Web Exploitation Tools - Automated server-side template injection and server takeover.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
