wanderer/ PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-05-04 10:56:21 +02:00
Code Issues Releases Activity

Added TInjA and the Template Injection Table 

Both are novel tools to help Pentesters / Bug bounty hunters to detect template injections
This commit is contained in:
Maximilian Hildebrand 2023-12-03 13:15:47 +01:00 committed by GitHub
parent 57703ed7ed
commit db1357bb3c
Signed by: GitHub
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
Server Side Template Injection/README.md
View File

@ -86,6 +86,15 @@
Recommended tools:
[TInjA](https://github.com/Hackmanit/TInjA) - An effiecient SSTI + CSTI scanner which utilizes novel polyglots
e.g:
```bash
tinja url -u "http://example.com/?name=Kirlia" -H "Authentication: Bearer ey..."
tinja url -u "http://example.com/" -d "username=Kirlia" -c "PHPSESSID=ABC123..."
```
[Tplmap](https://github.com/epinna/tplmap) - Server-Side Template Injection and Code Injection Detection and Exploitation Tool
e.g:
@ -119,6 +128,8 @@ In most cases, this polyglot payload will trigger an error in presence of a SSTI
${{<%[%'"}}%\.
```
The [Template Injection Table](https://github.com/Hackmanit/template-injection-table) is an interactive table containing the most efficient template injection polyglots along with the expected responses of the 44 most important template engines.
## ASP.NET Razor
[Official website](https://docs.microsoft.com/en-us/aspnet/web-pages/overview/getting-started/introducing-razor-syntax-c)