Open alasalamont opened 8 months ago
same problem but the problem is the web not use template engine or maybe is just junk http packet maybe because error from web like 5xx or waf can cause false positive or the target web not vuln with ssti just junk http
@alasalamont Why is your case false positive? SSTImap correctly identified the template injection as rendered Freemarker
using another payload. It was unable to run OS commands, as it tried using bash
, but you still can inject template code to try different payloads. This works as intended, as bypassing waf is hard to automate.
I will work on improving the payload system though, as bash is not always present on the target.
@mrdragonblack the problem you described is most likely caused by blind detection with small delay. Increase the delay or disable blind detection
@alasalamont Why is your case false positive? SSTImap correctly identified the template injection as rendered
Freemarker
using another payload. It was unable to run OS commands, as it tried usingbash
, but you still can inject template code to try different payloads. This works as intended, as bypassing waf is hard to automate.I will work on improving the payload system though, as bash is not always present on the target.
Yup you are correct. I suggest add more some payload to test to double-check. Like in this case, the sysetm has no bash ^^
I suggest add more some payload to test to double-check. Like in this case, the sysetm has no bash
I will do something about that, making more payload variations once the language is detected.
Blind false positives should be fixed in 1.2.0 @mrdragonblack, can you verify?
As for payloads with bash - this will come in later versions
Hi brother, I did test SSTImap on this workshop, at
25_template_freemarker
When I use simple payload, it works
But when the tool use its payload, it does not work
The site returns
Because of this, the tool also return false positive result