epinna / tplmap

Server-Side Template Injection and Code Injection Detection and Exploitation Tool
GNU General Public License v3.0
3.69k stars 666 forks source link

Use printf for bash execution checking #100

Closed markozajc closed 2 years ago

markozajc commented 2 years ago

Using echo can cause issues, particularly because it produces newlines, which may be further encoded into "\\n" by the server, neither of which the reflection check understands. I've further made plugin.execute() automatically convert "\\n" into newlines.