security enabled verified high v1.0.0

tplmap

Server-Side Template Injection (SSTI) exploitation tool that automates detection and exploitation of template injection vulnerabilities across multiple template engines.

📋 Live Preview

tplmap {flag-data} {flag-cookie} {flag-user-agent} {flag-header} {flag-engine} {flag-os-shell} {flag-os-cmd} {flag-read-file} {flag-level} {flag-proxy} -u {url}

📎 flag-data 📎 flag-cookie 📎 flag-user-agent 📎 flag-header 📎 flag-engine 📎 flag-os-shell 📎 flag-os-cmd 📎 flag-read-file 📎 flag-level 📎 flag-proxy 📎 url

tplmap {flag-data} {flag-cookie} {flag-user-agent} {flag-header} {flag-engine} {flag-os-shell} {flag-os-cmd} {flag-read-file} {flag-level} {flag-proxy} -u {url}

Sandbox: execFile · Timeout: 300s

Capabilities

web.ssti.detect

web.ssti.exploit

web.ssti.rce

web.ssti.read-file

web.ssti.sandbox-escape

Parameters

Name	Type	Required	Default	Description	Aliases
`url`	string	Yes	-	Target URL	`-u`, `--url`
`flag-data`	string	No	-	POST data string	`-d`, `--data`
`flag-cookie`	string	No	-	HTTP Cookie header	`--cookie`
`flag-user-agent`	string	No	-	Custom User-Agent header	`--user-agent`
`flag-header`	string	No	-	Additional HTTP header	`-H`, `--header`
`flag-engine`	string	No	-	Force template engine (smarty, twig, jinja2, etc.)	`--engine`
`flag-os-shell`	boolean	No	-	Prompt for an interactive shell	`--os-shell`
`flag-os-cmd`	string	No	-	Execute a single OS command	`--os-cmd`
`flag-read-file`	string	No	-	Read a file from the server	`--read-file`
`flag-level`	integer	No	-	Detection level (1-5)	`--level`
`flag-proxy`	string	No	-	HTTP proxy	`--proxy`

Artifacts

Type	Description	MIME	Schema	Trust
`web.ssti.shell`	Remote shell access via SSTI	text/plain	-	verified
`web.ssti.output`	Command execution output	text/plain	-	verified

Contract

Inputs

web.target.url

Target URL with injection point

web.parameter.name

Parameter name to inject

Outputs

web.ssti.output

Command output or file content

web.ssti.shell

Interactive shell session

Side effects: network_traffic

Workflow Edges

Produces

web.ssti.outputweb.ssti.shell

Consumes

web.target.urlweb.parameter.name

Resource Profile

Resource	Value
CPU	low
Memory	128 MB
Network	low
Disk I/O	low

Examples

Basic SSTI detection

tplmap -u "http://example.com/page?name=test"

POST request with OS command execution

tplmap -u "http://example.com/submit" -d "name=test" --os-cmd "id"

Interactive shell

tplmap -u "http://example.com/page?name=test" --os-shell

Read file from server

tplmap -u "http://example.com/page?name=test" --read-file /etc/passwd

Documentation

Tplmap — Server-Side Template Injection Exploitation

tplmap is a Python-based tool for detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities. It supports multiple template engines including Jinja2, Twig, Smarty, Jade, Mako, and FreeMarker, enabling RCE, file reading, and sandbox escape.

Usage

# Basic detection
tplmap -u "http://target.com/page?name=test"

# POST request
tplmap -u "http://target.com/submit" -d "name=test"

# Execute command
tplmap -u "http://target.com/page?name=test" --os-cmd "whoami"

# Interactive shell
tplmap -u "http://target.com/page?name=test" --os-shell

# Read file
tplmap -u "http://target.com/page?name=test" --read-file /etc/passwd

Dependencies

python3

Related Tools

commixsqlmapnmap

References

tplmap GitHub