tplmap

Server-Side Template Injection and Code Injection Detection and Exploitation Tool

Name:tplmap

Category:Vulnerabilities

Publisher:trickest

Created:9/7/2021

Container:quay.io/trickest/tplmap:6f21501

Output Type:

License:Unknown

Source:View Source

Parameters

url · string · required

--urlTarget URL.

proxy · string

--proxyUse a proxy to connect to the target URL

cookie · string

-cCookies (e.g. 'Field1=Value1').

header · string

-HExtra headers (e.g. 'Header1: Value1').

tpl-code · string

--tpl-codeInject code in the template engine.

post-data · string

--dataData string to be sent through POST. It must be as query string: param1=value1&param2=value2.

technique · string

-tTechniques R(endered) T(ime-based blind). Default: RT.

user-agent · string

-AHTTP User-Agent header value.

force-level · boolean

--force-levelForce a LEVEL and CLEVEL to test.

http-method · string

-XForce usage of given HTTP method (e.g. PUT).

upload-file · file

--uploadUpload file to target.

injection-tag · string

--injection-tagUse string as injection tag (default '*').

backend-engine · string

-eForce back-end template engine to this value.

os-cmd-to-execte · string

--os-cmdExecute an operating system command.

level-code-context · string

--levelLevel of code context escape to perform (1-5, Default:1).

force-overwrite-uploaded-files · boolean

--force-overwriteForce file overwrite when uploading.