PortSwigger Web Security Academy: fingerprinting Twig from errors, reading the app’s own source through an exposed object, and chaining its methods into a custom exploit that reads and deletes files.

PortSwigger Web Security Academy: server-side template injection in a code context, breaking out of a Tornado expression to reach command execution.

Cataract is a Bash tool that cascades escalating wordlist tiers through feroxbuster while running nmap in the background, for authorized web enumeration.

PortSwigger Web Security Academy: forcing an error to reveal Handlebars on Node.js, then adapting a documented exploit to reach remote code execution.

PortSwigger Web Security Academy: identifying FreeMarker from a verbose error and reading its own documentation to reach remote code execution.