Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add payloads to identify the template engine used #501

Merged
merged 4 commits into from
Sep 16, 2020
Merged

Add payloads to identify the template engine used #501

merged 4 commits into from
Sep 16, 2020

Conversation

righettod
Copy link
Contributor

Hi,

The objectives of this PR are the following:

  • Add missing expressions to the existing dictionary template-engines-expression.txt.
  • Add a new dictionary with payloads that can be used to identify the template engine used once a evaluation of an expression was identified using the first dictionary.
  • Initiate/complete the set of dictionaries for SSTI context in order to enhance the 2 dictionaries over the time and over the type of SSTI discovered during different web pentests.

Sources:

Thanks in advance 😃

See https://www.thymeleaf.org/doc/tutorials/3.0/usingthymeleaf.html#expression-inlining
Added it because I have discovered that, when StringTemplateResolver is used, then expression like ${42*42} is not resolved
The objective is to identify the engine once an expression evaluation pattern was identified.
@g0tmi1k
Copy link
Collaborator

g0tmi1k commented Sep 16, 2020

Thank you! 🎉

@g0tmi1k g0tmi1k merged commit 0b7d119 into danielmiessler:master Sep 16, 2020
@g0tmi1k g0tmi1k self-assigned this Sep 16, 2020
@g0tmi1k g0tmi1k added the enhancement Enhancement label Sep 16, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement Enhancement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants