tplmap

Automatically tests for SSTI across over 15 template engines, including Jinja2, Mako, and Twig, as detailed in the supported engines table, making it comprehensive for diverse web applications.

Implements advanced methods to bypass sandbox restrictions, based on public research and original contributions, enabling remote code execution and system access in vulnerable contexts.

Provides robust features like shell access, file read/write, and command execution, demonstrated in the exploitation examples with options for reverse/bind shells and file uploads.

Handles scenarios where injection results are not directly visible in responses, as mentioned in the key features, allowing exploitation in challenging black-box testing environments.