epinna/tplmap

Health v2 · maintenance only

Adoption not part of the score

4197 stars · 685 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Tplmap is a Python command-line tool that automatically detects and exploits Server-Side Template Injection (SSTI) and code injection vulnerabilities in web applications, using sandbox escape techniques to gain OS-level access. It supports many template engines (Jinja2, Mako, Smarty, etc.) and eval-like injections in Python, Ruby, PHP, and Java.

Use cases

• detect server-side template injection in a web app
• exploit SSTI to get remote code execution
• test if a URL parameter is vulnerable to template injection
• identify which template engine a web application uses
• perform sandbox escape during a penetration test
• find eval-like code injection vulnerabilities
• audit web apps for code injection during black box testing

When to choose

• you are pentesting a web application and suspect template injection
• you need to identify and exploit SSTI across many template engines
• you want an automated sqlmap-like tool for code injection

When to avoid

• you need a maintained tool - the project is no longer actively developed
• you need defensive scanning rather than offensive exploitation
• you are not authorized to test the target application

Facets

cli-tool · maturity maintenance

penetration-testing security cli security penetration-testing web-development python cli windows ssti code-injection template-injection offensive-security exploitation pentest-tool linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="epinna/tplmap")