修改在idea中运行tomcat

Author: JoyChou93

README.md

@@ -1,7 +1,16 @@
 # Java Security Code
 
+## 介绍
 
-- [XMLInject](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XMLInjection.java)
+该项目也可以叫做Java Vulnerability Code(Java漏洞代码)。
+
+每个漏洞类型代码默认存在安全漏洞（除非本身不存在漏洞），相关修复代码在注释里。
+
+详情可查看每个漏洞代码和注释。
+
+## 漏洞代码
+
+- [XXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XXE.java)
 - [SSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSRF.java)
 - [URLRedirect](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLRedirect.java)
 - [IPForge](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/IPForge.java)
@@ -10,7 +19,7 @@
 - [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java)
 - [Deserialize](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Deserialize.java)
 
-## Usage
+## 如何运行
 
 
 ### Tomcat
@@ -32,7 +41,21 @@ Viarus
 
 ### IDEA
 
-如果想在IDEA中直接运运行，需要进行两个操作:
+如果想在IDEA中直接运行，需要在IDEA中添加Tomcat配置，步骤如下：
+
+```
+Run -> Edit Configurations -> 添加TomcatServer(Local) -> Server中配置Tomcat路径 -> Deployment中添加Artifact选择java-sec-code:war exploded
+```
+
 
-1. 覆盖适配IDEA的pom.xml `mv pom.xml.idea pom.xml`
-2. 覆盖适配IDEA的Application.java文件 `mv Application.java.idea Application.java`
+配置完成后，右上角直接点击run，即可运行。
+
+```
+http://localhost:8080/rce/exec?cmd=whoami
+```
+ 
+返回
+
+``` 
+Viarus
+```

idea-tomcat.png

@@ -45,6 +45,7 @@
         <SOURCES />
       </library>
     </orderEntry>
+    <orderEntry type="library" scope="PROVIDED" name="Maven: org.apache.tomcat:tomcat-servlet-api:8.0.36" level="project" />
     <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-web:1.5.1.RELEASE" level="project" />
     <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter:1.5.1.RELEASE" level="project" />
     <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot:1.5.1.RELEASE" level="project" />

java-sec-code.iml

@@ -9,9 +9,9 @@
 import javax.servlet.http.HttpServletResponse;
 
 /**
- * author: JoyChou ([email protected])
- * date:   2018.01.03
- * desc:   Java no http response splitting vuls (test in Java 1.7/1.8)
+ * @author: JoyChou ([email protected])
+ * @date:   2018.01.03
+ * @desc:   Java 1.7/1.8没有CRLF漏洞 (test in Java 1.7/1.8)
  */
 
 @Controller

pom.xml.idea

@@ -11,8 +11,8 @@
 
 /**
  * @author: JoyChou
- * @Date: 2018年06月14日
- * @Desc：将根目录的poc放到/tmp/poc就能在mac上弹计算器。该应用必须有Commons-Collections包才能利用反序列化。
+ * @Date:   2018年06月14日
+ * @Desc：  将根目录的poc放到/tmp/poc就能在mac上弹计算器。该应用必须有Commons-Collections包才能利用反序列化。
  */
 
 @Controller

src/main/java/org/joychou/Application.java.idea

@@ -8,10 +8,10 @@
 import javax.servlet.http.HttpServletRequest;
 
 /**
- * author: JoyChou ([email protected])
- * date:   2017.12.29
- * desc:   Java IP Forge security code
- * detail: https://joychou.org/web/how-to-get-real-ip.html
+ * @author: JoyChou ([email protected])
+ * @date:   2017.12.29
+ * @desc:   Java获取IP安全代码
+ * @detail: 关于获取IP不安全代码，详情可查看https://joychou.org/web/how-to-get-real-ip.html
  */
 
 @Controller

src/main/java/org/joychou/controller/CRLFInjection.java

@@ -8,9 +8,9 @@
 
 
 /**
- * author: JoyChou ([email protected])
- * date:   2018.05.28
- * desc:   Index Page
+ * @author: JoyChou ([email protected])
+ * @date:   2018.05.28
+ * @desc:   Index Page
  */
 
 @Controller

src/main/java/org/joychou/controller/Deserialize.java

@@ -10,10 +10,10 @@
 import java.io.InputStreamReader;
 
 /**
- * author: JoyChou ([email protected])
- * date:   2018.05.24
- * desc:   java xxe vuls code
- * fix:    filter parameters
+ * @author: JoyChou ([email protected])
+ * @date:   2018.05.24
+ * @desc:   java xxe vuls code
+ * @fix:    过滤造成命令执行的参数
  */
 
 @Controller