X-TPL
tplmap
Automates detection and exploitation of server-side template injection (SSTI).
OVERVIEW
tplmap injects a series of template-syntax payloads into a parameter and inspects the response to fingerprint which template engine (Jinja2, Twig, Freemarker, Smarty, and more across Python, PHP, Java, Node, and Ruby) is rendering it and how it's configured. Once it confirms injection, it can escalate automatically toward reading files, writing a webshell, or a full reverse shell, depending on what the sandboxed engine allows.
It plays a role for SSTI similar to what sqlmap plays for SQL injection: turning a manual, engine-specific payload hunt into a scripted detection-then-exploitation workflow across a wide range of frameworks.
USE CASES
Practical use cases
- 01
Confirming whether a parameter that reflects template-like syntax is actually vulnerable to SSTI.
- 02
Fingerprinting which template engine and language a suspicious app is built on.
- 03
Escalating a confirmed SSTI to file read or remote code execution to demonstrate real impact.
- 04
Testing multiple template engines automatically when the underlying framework isn't known.
QUICK START
Once a parameter looks like it might be rendered through a server-side template engine, to confirm SSTI and measure how far it escalates.
- Confirm the target parameter reflects input in a way consistent with template rendering (e.g. {{7*7}} returns 49).
- Run tplmap against the endpoint and parameter to fingerprint the engine and confirm injection.
- Use its built-in options to attempt file read or command execution once injection is confirmed.
- Document the exact payload and engine so the finding is reproducible in the report.
tplmap.py -u 'https://target.com/page?name=John'BEFORE YOU RUN IT
What to check before running it
Command-execution and file-read payloads run real code on the server — only escalate that far when scope and rules of engagement explicitly allow it.
It's unmaintained relative to the pace of template-engine updates, so it can miss newer engines or sandboxed configurations; a manual payload may still be needed.
Aggressive fingerprinting can throw errors visible to monitoring or WAFs — coordinate timing on sensitive targets.