This tool is capable of exploiting some code context escapes and blind injection scenarios. It also supports eval()-like code injections in Java, JavaScript, PHP, Python, Ruby and generic unsandboxed template engines.

Key differences with Tplmap

Even though this software is based on Tplmap's code, backwards compatibility is not provided.

• Added two new techniques for SSTI detection and exploitation
• Interactive mode (-i) allowing for easier exploitation and detection
• Simple evaluation payloads as response markers in case of payload reflection
• Added new payloads for generic templates, to test all contexts use --generic
• Generic evaluating template injection detection using Eval_generic module
• Base language eval()-like shell (-x) or single command (-X) execution
• Blind file upload now supports MD5 confirmation and file existence check
• Added new payloads for more templates and updated many existing payloads
• Modular plugin structure that allows additional plugin installation
• Support for different POST data types
• Added crawling and form detection
• Short versions added to many arguments
• Some old command line arguments were changed, check -h for help
• Code is changed to use newer python features
• Burp Suite extension temporarily removed, as Jython doesn't support Python3

Server-Side Template Injection

This is an example of a simple website written in Python using Flask framework and Jinja2 template engine. It integrates user-supplied variable name in an unsafe way, as it is concatenated to the template string before rendering.

Not only this way of using templates creates XSS vulnerability, but it also allows the attacker to inject template code, that will be executed on the server, leading to SSTI.

User-supplied input should be introduced in a safe way through rendering context:

Predetermined mode

SSTImap in predetermined mode is very similar to Tplmap. It is capable of detecting and exploiting SSTI vulnerabilities in multiple different templates.

After the exploitation, SSTImap can provide access to code evaluation, OS command execution and file system manipulations.

To check the URL, you can use -u argument:

Use --os-shell option to launch a pseudo-terminal on the target.

To get a full list of options, use --help argument.

Interactive mode

In interactive mode, commands are used to interact with SSTImap. To enter interactive mode, you can use -i argument. All other arguments, except for the ones regarding exploitation payloads, will be used as initial values for settings.

Some commands are used to alter settings between test runs. To run a test, target URL must be supplied via initial -u argument or url command. After that, you can use run command to check URL for SSTI.

If SSTI was found, commands can be used to start the exploitation. You can get the same exploitation capabilities, as in the predetermined mode, but you can use Ctrl+C to abort them without stopping a program.

By the way, test results are valid until target url is changed, so you can easily switch between exploitation methods without running detection test every time.

To get a full list of interactive commands, use command help in interactive mode.

Supported template engines

SSTImap supports multiple template engines and eval()-like injections.

New payloads are welcome in PRs. Check out the tips to speed up development.

Techniques: (R)endered, (E)rror-based, (B)oolean error-based blind and (T)ime-based blind; Lowercase letter marks partially supported technique

More plugins and payloads can be found in SSTImap Extra Plugins repository.

Burp Suite Plugin

Currently, Burp Suite only works with Jython as a way to execute python2. Python3 functionality is not provided.

Future plans

If you plan to contribute something big from this list, inform me to avoid working on the same thing as me or other contributors.

• Add more payloads for different engines
• Make plugins less dependent on base plugins
• Parse raw HTTP request from file
• Variable dumping functionality
• Blind/side-channel value extraction
• Better documentation (or at least any documentation)
• Short arguments as interactive commands?
• JSONL/plaintext API modes for scripting integrations?
• Better integration for Python scripts
• Multipart POST data type support
• Modules for more customisable requests (second order, reset, non-HTTP)
• Payload processing scripts
• Better config functionality
• Saving found vulnerabilities
• Reports in HTML or other format
• Multiline language evaluation?
• Avoid platform dependency in payloads
• Test multiple shells in exec-based RCE scenarios
• Update NodeJS payloads as process.mainModule may be undefined
• Spider/crawler automation (by fantesykikachu)
• Automatic languages and engines import
• More POST data types support
• Make template and base language evaluation functionality more uniform
• Argument to remove escape codes?