Skip to content

Commit 707d395

Browse files
JoyChou93JoyChou93
committed
add jwt
1 parent ed28104 commit 707d395

File tree

13 files changed

+287
-5
lines changed

13 files changed

+287
-5
lines changed

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ Sort by letter.
5757
- [XSS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XSS.java)
5858
- [XStream](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XStreamRce.java)
5959
- [XXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XXE.java)
60-
60+
- [JWT](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Jwt.java)
6161

6262

6363
## Vulnerability Description
@@ -75,6 +75,7 @@ Sort by letter.
7575
- [SSTI](https://github.com/JoyChou93/java-sec-code/wiki/SSTI)
7676
- [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass)
7777
- [XXE](https://github.com/JoyChou93/java-sec-code/wiki/XXE)
78+
- [JWT](https://github.com/JoyChou93/java-sec-code/wiki/JWT)
7879
- [Others](https://github.com/JoyChou93/java-sec-code/wiki/others)
7980

8081
## How to run

‎README_zh.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ joychou/joychou123
5151
- [XSS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XSS.java)
5252
- [XStream](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XStreamRce.java)
5353
- [XXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XXE.java)
54-
54+
- [JWT](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Jwt.java)
5555

5656
## 漏洞说明
5757

@@ -68,6 +68,7 @@ joychou/joychou123
6868
- [SSTI](https://github.com/JoyChou93/java-sec-code/wiki/SSTI)
6969
- [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass)
7070
- [XXE](https://github.com/JoyChou93/java-sec-code/wiki/XXE)
71+
- [JWT](https://github.com/JoyChou93/java-sec-code/wiki/JWT)
7172
- [Others](https://github.com/JoyChou93/java-sec-code/wiki/others)
7273

7374

‎java-sec-code.iml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,6 @@
8686
<orderEntry type="library" name="Maven: org.apache.commons:commons-digester3:3.2" level="project" />
8787
<orderEntry type="library" name="Maven: cglib:cglib:2.2.2" level="project" />
8888
<orderEntry type="library" name="Maven: asm:asm:3.3.1" level="project" />
89-
<orderEntry type="library" name="Maven: commons-beanutils:commons-beanutils:1.9.3" level="project" />
9089
<orderEntry type="library" name="Maven: org.jolokia:jolokia-core:1.6.0" level="project" />
9190
<orderEntry type="library" name="Maven: com.googlecode.json-simple:json-simple:1.1.1" level="project" />
9291
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-actuator:1.5.1.RELEASE" level="project" />
@@ -219,5 +218,8 @@
219218
<orderEntry type="library" name="Maven: org.springframework:spring-test:4.3.6.RELEASE" level="project" />
220219
<orderEntry type="library" name="Maven: junit:junit:4.12" level="project" />
221220
<orderEntry type="library" name="Maven: org.hamcrest:hamcrest-core:1.3" level="project" />
221+
<orderEntry type="library" name="Maven: commons-beanutils:commons-beanutils:1.9.4" level="project" />
222+
<orderEntry type="library" name="Maven: io.jsonwebtoken:jjwt:0.9.1" level="project" />
223+
<orderEntry type="library" name="Maven: com.auth0:java-jwt:4.0.0" level="project" />
222224
</component>
223225
</module>

‎pom.xml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -279,6 +279,27 @@
279279
<artifactId>junit</artifactId>
280280
</dependency>
281281

282+
<!-- add commons-beanutils gadget -->
283+
<dependency>
284+
<groupId>commons-beanutils</groupId>
285+
<artifactId>commons-beanutils</artifactId>
286+
<version>1.9.4</version>
287+
</dependency>
288+
289+
<!-- https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt -->
290+
<dependency>
291+
<groupId>io.jsonwebtoken</groupId>
292+
<artifactId>jjwt</artifactId>
293+
<version>0.9.1</version>
294+
</dependency>
295+
296+
<!-- https://github.com/auth0/java-jwt https://mvnrepository.com/artifact/com.auth0/java-jwt -->
297+
<dependency>
298+
<groupId>com.auth0</groupId>
299+
<artifactId>java-jwt</artifactId>
300+
<version>4.0.0</version>
301+
</dependency>
302+
282303
</dependencies>
283304

284305
<dependencyManagement>

‎src/main/java/org/joychou/Application.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
import org.springframework.cloud.netflix.eureka.EnableEurekaClient;
99

1010

11-
1211
@ServletComponentScan // do filter
1312
@SpringBootApplication
1413
// @EnableEurekaClient // 测试Eureka请打开注释，防止控制台一直有warning

‎src/main/java/org/joychou/controller/Deserialize.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,9 @@ public String rememberMeVul(HttpServletRequest request)
5757

5858
/**
5959
* Check deserialize class using black list.
60+
* Or
61+
* Update commons-collections to 3.2.2 or above.
62+
* Serialization support for org.apache.commons.collections.functors.InvokerTransformer is disabled for security reasons.To enable it set system property 'org.apache.commons.collections.enableUnsafeSerialization' to 'true',but you must ensure that your application does not de-serialize objects from untrusted sources.
6063
* <p>
6164
* http://localhost:8080/deserialize/rememberMe/security
6265
*/

‎src/main/java/org/joychou/controller/Jwt.java‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
package org.joychou.controller;
2+
3+
import lombok.extern.slf4j.Slf4j;
4+
import org.joychou.util.CookieUtils;
5+
import org.joychou.util.JwtUtils;
6+
import org.springframework.web.bind.annotation.CookieValue;
7+
import org.springframework.web.bind.annotation.GetMapping;
8+
import org.springframework.web.bind.annotation.RequestMapping;
9+
import org.springframework.web.bind.annotation.RestController;
10+
11+
import javax.servlet.http.Cookie;
12+
import javax.servlet.http.HttpServletRequest;
13+
import javax.servlet.http.HttpServletResponse;
14+
15+
16+
/**
17+
*
18+
*/
19+
@Slf4j
20+
@RestController
21+
@RequestMapping("/jwt")
22+
public class Jwt {
23+
24+
private static final String COOKIE_NAME = "USER_COOKIE";
25+
/**
26+
* http://localhost:8080/jwt/createToken
27+
* Create jwt token and set token to cookies.
28+
*
29+
* @author JoyChou 2022-09-20
30+
*/
31+
@GetMapping("/createToken")
32+
public String createToken(HttpServletResponse response, HttpServletRequest request) {
33+
String loginUser = request.getUserPrincipal().getName();
34+
log.info("Current login user is " + loginUser);
35+
36+
CookieUtils.deleteCookie(response, COOKIE_NAME);
37+
String token = JwtUtils.generateTokenByJavaJwt(loginUser);
38+
Cookie cookie = new Cookie(COOKIE_NAME, token);
39+
40+
cookie.setMaxAge(86400); // 1 DAY
41+
cookie.setPath("/");
42+
cookie.setSecure(true);
43+
response.addCookie(cookie);
44+
return "Add jwt token cookie successfully. Cookie name is USER_COOKIE";
45+
}
46+
47+
48+
/**
49+
* http://localhost:8080/jwt/getName
50+
* Get nickname from USER_COOKIE
51+
*
52+
* @author JoyChou 2022-09-20
53+
* @param user_cookie cookie
54+
* @return nickname
55+
*/
56+
@GetMapping("/getName")
57+
public String getNickname(@CookieValue(COOKIE_NAME) String user_cookie) {
58+
String nickname = JwtUtils.getNicknameByJavaJwt(user_cookie);
59+
return "Current jwt user is " + nickname;
60+
}
61+
62+
}

‎src/main/java/org/joychou/controller/SQLI.java‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,50 @@ public String jdbc_sqli_sec(@RequestParam("username") String username) {
130130
return result.toString();
131131
}
132132

133+
134+
/**
135+
* http://localhost:8080/sqli/jdbc/ps/vuln?username=joychou' or 'a'='a
136+
*
137+
* Incorrect use of prepareStatement. prepareStatement must use ? as a placeholder.
138+
*/
139+
@RequestMapping("/jdbc/ps/vuln")
140+
public String jdbc_ps_vuln(@RequestParam("username") String username) {
141+
142+
StringBuilder result = new StringBuilder();
143+
try {
144+
Class.forName(driver);
145+
Connection con = DriverManager.getConnection(url, user, password);
146+
147+
if (!con.isClosed())
148+
System.out.println("Connecting to Database successfully.");
149+
150+
String sql = "select * from users where username = '" + username + "'";
151+
PreparedStatement st = con.prepareStatement(sql);
152+
153+
logger.info(st.toString());
154+
ResultSet rs = st.executeQuery();
155+
156+
while (rs.next()) {
157+
String res_name = rs.getString("username");
158+
String res_pwd = rs.getString("password");
159+
String info = String.format("%s: %s\n", res_name, res_pwd);
160+
result.append(info);
161+
logger.info(info);
162+
}
163+
164+
rs.close();
165+
con.close();
166+
167+
} catch (ClassNotFoundException e) {
168+
logger.error("Sorry, can`t find the Driver!");
169+
e.printStackTrace();
170+
} catch (SQLException e) {
171+
logger.error(e.toString());
172+
}
173+
return result.toString();
174+
}
175+
176+
133177
/**
134178
* vuln code
135179
* http://localhost:8080/sqli/mybatis/vuln01?username=joychou' or '1'='1

‎src/main/java/org/joychou/controller/SSRF.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,11 @@ public String httpURLConnection(@RequestParam String url) {
7676
}
7777

7878

79+
@GetMapping("/HttpURLConnection/vuln")
80+
public String httpURLConnectionVuln(@RequestParam String url) {
81+
return HttpUtils.HttpURLConnection(url);
82+
}
83+
7984
/**
8085
* The default setting of followRedirects is true.
8186
* UserAgent is <code>Apache-HttpClient/4.5.12 (Java/1.8.0_102)</code>.

‎src/main/java/org/joychou/util/CookieUtils.java‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
package org.joychou.util;
2+
3+
import lombok.extern.slf4j.Slf4j;
4+
5+
import javax.servlet.http.Cookie;
6+
import javax.servlet.http.HttpServletResponse;
7+
8+
9+
@Slf4j
10+
public class CookieUtils {
11+
12+
public static boolean deleteCookie(HttpServletResponse res, String cookieName) {
13+
try {
14+
Cookie cookie = new Cookie(cookieName, null);
15+
cookie.setMaxAge(0);
16+
cookie.setPath("/");
17+
res.addCookie(cookie);
18+
return true;
19+
} catch (Exception e) {
20+
log.error(e.toString());
21+
return false;
22+
}
23+
}
24+
}

0 commit comments

Comments
 (0)