epinna/tplmap
Tplmap
tplmap 是一款旨在检测和利用服务器端模板注入 (SSTI) 漏洞的安全工具。它作为一个自动化扫描器，用于识别易受攻击的模板引擎上下文，并提供了一个实现远程代码执行的框架。
该工具专注于将高级请求转换为引擎特定的语法，以执行操作系统命令并绕过应用沙箱。它还支持远程文件系统访问，允许用户在本地机器和目标服务器之间读取、写入和传输文件。
其他功能包括启动本地易受攻击的服务器以模拟有缺陷的环境进行 Payload 验证。该项目还支持与 Web 安全代理集成，以自动化将测试 Payload 注入到拦截的流量中。
Features
- Server-Side Template Injection Detection - Automates the detection and exploitation of server-side template injection vulnerabilities.
- Shell Command Execution - Executes arbitrary operating system shell commands by bypassing application sandboxes.
- Engine-Specific Templates - Generates targeted injection strings based on the identified template engine to bypass security filters.
- Remote Code Execution Tools - Provides a framework to achieve and manage arbitrary code execution via template injection.
- Remote Access Payloads - Translates high-level requests into engine-specific syntax to execute operating system commands on target servers.
- Injection Mapping - Identifies vulnerable engines by sending polyglot payloads and analyzing server response patterns.
- Web Application Penetration Testing - Automates the discovery of injection flaws in web servers during active security assessments.
- Remote File Transfers - Facilitates moving files between local and remote systems by leveraging template engine primitives.
- Remote File Read-Write Operations - Provides the ability to read and write files on a remote server via template injection.
- Bidirectional Host-to-Server File Transfers - Moves files bidirectionally between local machines and remote servers using active injection points.
- Vulnerable Server Simulations - Launches containerized web servers running flawed template engines to validate exploit payloads.
- Vulnerable Scenario Deployments - Deploys intentionally misconfigured local web servers to verify tool functionality.
- File System Access Controls - Leverages template engine flaws to read sensitive data from or write files to the target file system.
- Vulnerability Simulations - Simulates vulnerable template engine environments for practicing exploitation techniques.
- Vulnerability Scanners - SSTI and code injection detection tool.
- Command and Template Injection - Detects and exploits server-side template and code injection.
- Fuzzing and Injection - Detects and exploits code and server-side template injections.
- Specialized Vulnerability Scanners - Tool for detecting and exploiting server-side template injection vulnerabilities.
- SSTI Injection - Tool for detecting and exploiting SSTI and code injection.
- Template Injection Tools - Automated tool for exploiting code and template injection vulnerabilities.
- Vulnerability Exploitation Frameworks - Detects and exploits server-side template injection.
- Web Exploitation - Exploits Server-Side Template Injection vulnerabilities.
- Web Exploitation Tools - Automated server-side template injection and server takeover.
