epinna/tplmap
Tplmap
tplmap este un instrument de securitate conceput pentru detectarea și exploatarea vulnerabilităților de tip server-side template injection. Acesta funcționează ca un scaner automatizat pentru a identifica contextele vulnerabile ale motoarelor de template-uri și oferă un framework pentru obținerea execuției de cod la distanță (RCE).
Instrumentul se concentrează pe traducerea cererilor de nivel înalt în sintaxă specifică motorului pentru a executa comenzi de sistem și a ocoli sandbox-urile aplicațiilor. De asemenea, permite accesul la sistemul de fișiere de la distanță, permițând utilizatorilor să citească, să scrie și să transfere fișiere între o mașină locală și un server țintă.
Capabilitățile suplimentare includ posibilitatea de a lansa servere locale vulnerabile pentru a simula medii compromise în vederea verificării payload-urilor. Proiectul suportă, de asemenea, integrarea cu proxy-uri de securitate web pentru a automatiza injectarea de payload-uri de test în traficul interceptat.
Features
- Server-Side Template Injection Detection - Automates the detection and exploitation of server-side template injection vulnerabilities.
- Shell Command Execution - Executes arbitrary operating system shell commands by bypassing application sandboxes.
- Engine-Specific Templates - Generates targeted injection strings based on the identified template engine to bypass security filters.
- Remote Code Execution Tools - Provides a framework to achieve and manage arbitrary code execution via template injection.
- Remote Access Payloads - Translates high-level requests into engine-specific syntax to execute operating system commands on target servers.
- Injection Mapping - Identifies vulnerable engines by sending polyglot payloads and analyzing server response patterns.
- Web Application Penetration Testing - Automates the discovery of injection flaws in web servers during active security assessments.
- Remote File Transfers - Facilitates moving files between local and remote systems by leveraging template engine primitives.
- Remote File Read-Write Operations - Provides the ability to read and write files on a remote server via template injection.
- Bidirectional Host-to-Server File Transfers - Moves files bidirectionally between local machines and remote servers using active injection points.
- Vulnerable Server Simulations - Launches containerized web servers running flawed template engines to validate exploit payloads.
- Vulnerable Scenario Deployments - Deploys intentionally misconfigured local web servers to verify tool functionality.
- File System Access Controls - Leverages template engine flaws to read sensitive data from or write files to the target file system.
- Vulnerability Simulations - Simulates vulnerable template engine environments for practicing exploitation techniques.
- Vulnerability Scanners - SSTI and code injection detection tool.
- Command and Template Injection - Detects and exploits server-side template and code injection.
- Fuzzing and Injection - Detects and exploits code and server-side template injections.
- Specialized Vulnerability Scanners - Tool for detecting and exploiting server-side template injection vulnerabilities.
- SSTI Injection - Tool for detecting and exploiting SSTI and code injection.
- Template Injection Tools - Automated tool for exploiting code and template injection vulnerabilities.
- Vulnerability Exploitation Frameworks - Detects and exploits server-side template injection.
- Web Exploitation - Exploits Server-Side Template Injection vulnerabilities.
- Web Exploitation Tools - Automated server-side template injection and server takeover.
