How do I force a template engine?

Pass -e when you already know the back end. Otherwise tplmap fingerprints the engine from probe responses.

Can tplmap run OS commands or upload files?

Once a context is confirmed, --os-cmd runs a single OS command through the injection, and --upload writes a file (--force-overwrite replaces an existing one).

Where can I inject besides the query string?

Use --data for POST bodies, -c for cookies, -H for headers, and -A for User-Agent. Mark the injection spot with --injection-tag (default *).

tplmap vs nuclei for SSTI?

nuclei can flag some SSTI patterns among many templates. tplmap specializes in confirming the engine context and exploiting it with commands or uploads.

Updated Jul 14, 2026

Vulnerabilities

Confirm server-side template injection to code execution

Detect and exploit server-side template injection on live parameters.

Detect template injection on live endpoints Catch blind injections with timing Demonstrate code execution

overview

What tplmap does

In a Trickest Vulnerabilities workflow, tplmap takes a parameterized --url (plus optional --data, -c, or -H) and writes confirmed SSTI findings as file and folder outputs.

Reach for it when user input may reach a template engine. Probes with -t (rendered and time-based blind by default), optional -e for a known engine, and --level for code-context escape depth.

sqlmap covers SQL injection; nuclei has shallow SSTI templates among many checks. tplmap stays on one class: confirm the engine context, then prove impact with --os-cmd or --upload.

source github.com/epinna/tplmap

use cases

Where tplmap fits

Detect template injection on live endpoints

Feed parameterized URLs to tplmap so it probes each input, fingerprints the rendering engine, and confirms whether user data is evaluated as template code rather than printed.

Catch blind injections with timing

Use the time-based blind technique to flag injections that never reflect output, so a vulnerable but silent endpoint still surfaces from response timing alone.

Demonstrate code execution

Once a context is confirmed, run an OS command with --os-cmd or upload a file to prove the finding leads to execution, not only to a rendered expression.

Test inputs in any position

Inject through cookies, headers, POST data, or the URL so endpoints that take input outside the query string are still covered.

reference

tplmap inputs and flags

16 inputs

Name	Type	Flag	Description
url	STRING	--url	Target URL to test.
post-data	STRING	--data	Data sent via POST, as a query string (param1=value1&param2=value2).
technique	STRING	-t	Techniques: R(endered), T(ime-based blind). Default RT.
header	STRING	-H	Extra headers, for example Header1: Value1.
cookie	STRING	-c	Cookies, for example Field1=Value1.
backend-engine	STRING	-e	Force the back-end template engine to a specific value.
os-cmd-to-execte	STRING	--os-cmd	Execute an operating-system command through a confirmed injection.
level-code-context	STRING	--level	Level of code-context escape to perform (1 to 5, default 1).

Showing key inputs. tplmap exposes 16 inputs in total.

Full flag reference (16 inputs)

Name	Type	Flag	Description
url	STRING	--url	Target URL.
proxy	STRING	--proxy	Use a proxy to connect to the target URL.
cookie	STRING	-c	Cookies (for example Field1=Value1).
header	STRING	-H	Extra headers (for example Header1: Value1).
tpl-code	STRING	--tpl-code	Inject code in the template engine.
post-data	STRING	--data	Data string to send via POST, as a query string: param1=value1&param2=value2.
technique	STRING	-t	Techniques R(endered), T(ime-based blind). Default RT.
user-agent	STRING	-A	HTTP User-Agent header value.
force-level	BOOLEAN	--force-level	Force a LEVEL and CLEVEL to test.
http-method	STRING	-X	Force usage of a given HTTP method (for example PUT).
upload-file	FILE	--upload	Upload a file to the target.
injection-tag	STRING	--injection-tag	Use a string as the injection tag (default *).
backend-engine	STRING	-e	Force the back-end template engine to this value.
os-cmd-to-execte	STRING	--os-cmd	Execute an operating-system command.
level-code-context	STRING	--level	Level of code-context escape to perform (1 to 5, default 1).
force-overwrite-uploaded-files	BOOLEAN	--force-overwrite	Force file overwrite when uploading.

example

Run tplmap

tplmap · command

# detect SSTI on a query parameter, then run one OS command if confirmedtplmap --url 'https://example.com/greeting?name=test' --os-cmd 'id'

sample output

[+] Tplmap 0.5[+] Testing if GET parameter 'name' is injectable[+] Jinja2 plugin has confirmed injection with tag '{{*}}'[+] Tplmap identified the following injection point:      GET parameter: name      Engine: Jinja2      Injection: {{*}}      Context: text      Capabilities: Shell command execution: ok, Code evaluation: ok[+] Run commands on the operating system.

guidance

Choosing tplmap

Use tplmap when a parameterized endpoint may evaluate template input. For SQL injection use sqlmap; for broad templated checks use nuclei. Feed it URLs a crawler has already found.

sqlmap

Detects and exploits SQL injection. Same exploitation depth, different vulnerability class.

nuclei

Template-based scanner with some SSTI checks among thousands. tplmap goes deeper on confirming and exploiting this class.

katana

Crawls to find parameterized endpoints tplmap then tests. Run it upstream.

faq

tplmap questions

Yes. Include the time-based blind technique with -t T (default RT runs rendered and blind together). Timing confirms injections that never reflect output.

Run tplmap yourself

A target feeds katana, which crawls for parameterized endpoints and passes them to tplmap, which tests for template injection and writes the findings.

Run tplmap in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

url

STRING

--url

Target URL to test.

post-data

STRING

--data

Data sent via POST, as a query string (param1=value1&param2=value2).

technique

STRING

-t

Techniques: R(endered), T(ime-based blind). Default RT.

header

STRING

-H

Extra headers, for example Header1: Value1.

STRING

-c

Cookies, for example Field1=Value1.

backend-engine

STRING

-e

Force the back-end template engine to a specific value.

os-cmd-to-execte

STRING

--os-cmd

Execute an operating-system command through a confirmed injection.

level-code-context

STRING

--level

Level of code-context escape to perform (1 to 5, default 1).

Name

Type

Flag

Description

url

STRING

--url

Target URL.

proxy

STRING

--proxy

Use a proxy to connect to the target URL.

STRING

-c

Cookies (for example Field1=Value1).

header

STRING

-H

Extra headers (for example Header1: Value1).

tpl-code

STRING

--tpl-code

Inject code in the template engine.

post-data

STRING

--data

Data string to send via POST, as a query string: param1=value1&param2=value2.

technique

STRING

-t

Techniques R(endered), T(ime-based blind). Default RT.

user-agent

STRING

-A

HTTP User-Agent header value.

force-level

BOOLEAN

--force-level

Force a LEVEL and CLEVEL to test.

http-method

STRING

-X

Force usage of a given HTTP method (for example PUT).

upload-file

FILE

--upload

Upload a file to the target.

injection-tag

STRING

--injection-tag

Use a string as the injection tag (default *).

backend-engine

STRING

-e

Force the back-end template engine to this value.

os-cmd-to-execte

STRING

--os-cmd

Execute an operating-system command.

level-code-context

STRING

--level

Level of code-context escape to perform (1 to 5, default 1).

force-overwrite-uploaded-files

BOOLEAN

--force-overwrite

Force file overwrite when uploading.

[+] Tplmap 0.5[+] Testing if GET parameter 'name' is injectable[+] Jinja2 plugin has confirmed injection with tag '{{*}}'[+] Tplmap identified the following injection point: GET parameter: name Engine: Jinja2 Injection: {{*}} Context: text Capabilities: Shell command execution: ok, Code evaluation: ok[+] Run commands on the operating system.

Confirm server-side template injection to code execution

What tplmap does

Where tplmap fits

Detect template injection on live endpoints

Catch blind injections with timing

Demonstrate code execution

Test inputs in any position

tplmap inputs and flags

Run tplmap

Choosing tplmap

sqlmap

nuclei

katana

tplmap questions

More Vulnerabilities tools

commix

dnsreaper

find-gh-poc

jwt-tool

kxss

sqlmap

Run tplmap yourself

Confirm server-side template injection to code execution

What tplmap does

Where tplmap fits

Detect template injection on live endpoints

Catch blind injections with timing

Demonstrate code execution

Test inputs in any position

tplmap inputs and flags

Run tplmap

Choosing tplmap

sqlmap

nuclei

katana

tplmap questions

More Vulnerabilities tools

commix

dnsreaper

find-gh-poc

jwt-tool

kxss

sqlmap

Run tplmap yourself