Skip to content

Commit 3a5b947

Browse files
j3ers3j3ers3
committed
🍺 Java Sec
0 parents  commit 3a5b947

39 files changed

+1690
-0
lines changed

‎.gitignore‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
.idea
2+
.vscode
3+
/logs/
4+
/target/
5+
.apt_generated
6+
.classpath
7+
.factorypath
8+
.project
9+
.settings
10+
.springBeans
11+
.sts4-cache
12+
.DS_Store

‎README.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Hello Java Sec
2+
> 学习 Java 漏洞，记录一下代码
3+
4+
![](media/16254538162708.jpg)
5+
6+
7+
## Vulnerability
8+
- [ ] SQLi
9+
- [x] XSS
10+
- [x] RCE
11+
- [x] SSTI
12+
- [x] SpEL
13+
- [ ] SSRF
14+
- [ ] Directory Traversal
15+
- [ ] Redirect
16+
- [ ] CSRF
17+
- [ ] File Upload
18+
- [ ] XXE
19+
- [ ] Fastjson
20+
21+
## Run
22+
### IDEA
23+
配置环境run即可
24+
25+
### Jar
26+
```
27+
git clone https://github.com/j3ers3/Hello-Java-Sec
28+
mvn clean package -DskipTests
29+
java -jar hello-0.0.1-SNAPSHOT.jar
30+
```

‎hello.iml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module org.jetbrains.idea.maven.project.MavenProjectsManager.isMavenModule="true" type="JAVA_MODULE" version="4">
3+
<component name="FacetManager">
4+
<facet type="web" name="Web">
5+
<configuration>
6+
<webroots />
7+
<sourceRoots>
8+
<root url="file://$MODULE_DIR$/src/main/java" />
9+
<root url="file://$MODULE_DIR$/src/main/resources" />
10+
</sourceRoots>
11+
</configuration>
12+
</facet>
13+
<facet type="Spring" name="Spring">
14+
<configuration />
15+
</facet>
16+
</component>
17+
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_8">
18+
<output url="file://$MODULE_DIR$/target/classes" />
19+
<output-test url="file://$MODULE_DIR$/target/test-classes" />
20+
<content url="file://$MODULE_DIR$">
21+
<sourceFolder url="file://$MODULE_DIR$/src/main/java" isTestSource="false" />
22+
<sourceFolder url="file://$MODULE_DIR$/src/main/resources" type="java-resource" />
23+
<sourceFolder url="file://$MODULE_DIR$/src/test/java" isTestSource="true" />
24+
<excludeFolder url="file://$MODULE_DIR$/target" />
25+
</content>
26+
<orderEntry type="inheritedJdk" />
27+
<orderEntry type="sourceFolder" forTests="false" />
28+
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-jdbc:2.4.1" level="project" />
29+
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter:2.4.1" level="project" />
30+
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-logging:2.4.1" level="project" />
31+
<orderEntry type="library" name="Maven: ch.qos.logback:logback-classic:1.2.3" level="project" />
32+
<orderEntry type="library" name="Maven: ch.qos.logback:logback-core:1.2.3" level="project" />
33+
<orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-to-slf4j:2.13.3" level="project" />
34+
<orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-api:2.13.3" level="project" />
35+
<orderEntry type="library" name="Maven: org.slf4j:jul-to-slf4j:1.7.30" level="project" />
36+
<orderEntry type="library" name="Maven: jakarta.annotation:jakarta.annotation-api:1.3.5" level="project" />
37+
<orderEntry type="library" name="Maven: org.yaml:snakeyaml:1.27" level="project" />
38+
<orderEntry type="library" name="Maven: com.zaxxer:HikariCP:3.4.5" level="project" />
39+
<orderEntry type="library" name="Maven: org.slf4j:slf4j-api:1.7.30" level="project" />
40+
<orderEntry type="library" name="Maven: org.springframework:spring-jdbc:5.3.2" level="project" />
41+
<orderEntry type="library" name="Maven: org.springframework:spring-beans:5.3.2" level="project" />
42+
<orderEntry type="library" name="Maven: org.springframework:spring-tx:5.3.2" level="project" />
43+
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-thymeleaf:2.4.1" level="project" />
44+
<orderEntry type="library" name="Maven: org.thymeleaf:thymeleaf-spring5:3.0.11.RELEASE" level="project" />
45+
<orderEntry type="library" name="Maven: org.thymeleaf:thymeleaf:3.0.11.RELEASE" level="project" />
46+
<orderEntry type="library" name="Maven: org.attoparser:attoparser:2.0.5.RELEASE" level="project" />
47+
<orderEntry type="library" name="Maven: org.unbescape:unbescape:1.1.6.RELEASE" level="project" />
48+
<orderEntry type="library" name="Maven: org.thymeleaf.extras:thymeleaf-extras-java8time:3.0.4.RELEASE" level="project" />
49+
<orderEntry type="library" name="Maven: org.apache.velocity:velocity:1.7" level="project" />
50+
<orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.1" level="project" />
51+
<orderEntry type="library" name="Maven: commons-lang:commons-lang:2.4" level="project" />
52+
<orderEntry type="library" name="Maven: org.mybatis.spring.boot:mybatis-spring-boot-starter:2.1.4" level="project" />
53+
<orderEntry type="library" name="Maven: org.mybatis.spring.boot:mybatis-spring-boot-autoconfigure:2.1.4" level="project" />
54+
<orderEntry type="library" name="Maven: org.mybatis:mybatis:3.5.6" level="project" />
55+
<orderEntry type="library" name="Maven: org.mybatis:mybatis-spring:2.0.6" level="project" />
56+
<orderEntry type="library" scope="RUNTIME" name="Maven: mysql:mysql-connector-java:8.0.22" level="project" />
57+
<orderEntry type="library" scope="TEST" name="Maven: org.springframework.boot:spring-boot-starter-test:2.4.1" level="project" />
58+
<orderEntry type="library" scope="TEST" name="Maven: org.springframework.boot:spring-boot-test:2.4.1" level="project" />
59+
<orderEntry type="library" scope="TEST" name="Maven: org.springframework.boot:spring-boot-test-autoconfigure:2.4.1" level="project" />
60+
<orderEntry type="library" scope="TEST" name="Maven: com.jayway.jsonpath:json-path:2.4.0" level="project" />
61+
<orderEntry type="library" scope="TEST" name="Maven: net.minidev:json-smart:2.3" level="project" />
62+
<orderEntry type="library" scope="TEST" name="Maven: net.minidev:accessors-smart:1.2" level="project" />
63+
<orderEntry type="library" scope="TEST" name="Maven: org.ow2.asm:asm:5.0.4" level="project" />
64+
<orderEntry type="library" scope="TEST" name="Maven: jakarta.xml.bind:jakarta.xml.bind-api:2.3.3" level="project" />
65+
<orderEntry type="library" scope="TEST" name="Maven: jakarta.activation:jakarta.activation-api:1.2.2" level="project" />
66+
<orderEntry type="library" scope="TEST" name="Maven: org.assertj:assertj-core:3.18.1" level="project" />
67+
<orderEntry type="library" scope="TEST" name="Maven: org.hamcrest:hamcrest:2.2" level="project" />
68+
<orderEntry type="library" scope="TEST" name="Maven: org.junit.jupiter:junit-jupiter:5.7.0" level="project" />
69+
<orderEntry type="library" scope="TEST" name="Maven: org.junit.jupiter:junit-jupiter-api:5.7.0" level="project" />
70+
<orderEntry type="library" scope="TEST" name="Maven: org.apiguardian:apiguardian-api:1.1.0" level="project" />
71+
<orderEntry type="library" scope="TEST" name="Maven: org.opentest4j:opentest4j:1.2.0" level="project" />
72+
<orderEntry type="library" scope="TEST" name="Maven: org.junit.platform:junit-platform-commons:1.7.0" level="project" />
73+
<orderEntry type="library" scope="TEST" name="Maven: org.junit.jupiter:junit-jupiter-params:5.7.0" level="project" />
74+
<orderEntry type="library" scope="TEST" name="Maven: org.junit.jupiter:junit-jupiter-engine:5.7.0" level="project" />
75+
<orderEntry type="library" scope="TEST" name="Maven: org.junit.platform:junit-platform-engine:1.7.0" level="project" />
76+
<orderEntry type="library" scope="TEST" name="Maven: org.mockito:mockito-core:3.6.28" level="project" />
77+
<orderEntry type="library" scope="TEST" name="Maven: net.bytebuddy:byte-buddy:1.10.18" level="project" />
78+
<orderEntry type="library" scope="TEST" name="Maven: net.bytebuddy:byte-buddy-agent:1.10.18" level="project" />
79+
<orderEntry type="library" scope="TEST" name="Maven: org.objenesis:objenesis:3.1" level="project" />
80+
<orderEntry type="library" scope="TEST" name="Maven: org.mockito:mockito-junit-jupiter:3.6.28" level="project" />
81+
<orderEntry type="library" scope="TEST" name="Maven: org.skyscreamer:jsonassert:1.5.0" level="project" />
82+
<orderEntry type="library" scope="TEST" name="Maven: com.vaadin.external.google:android-json:0.0.20131108.vaadin1" level="project" />
83+
<orderEntry type="library" name="Maven: org.springframework:spring-core:5.3.2" level="project" />
84+
<orderEntry type="library" name="Maven: org.springframework:spring-jcl:5.3.2" level="project" />
85+
<orderEntry type="library" scope="TEST" name="Maven: org.springframework:spring-test:5.3.2" level="project" />
86+
<orderEntry type="library" scope="TEST" name="Maven: org.xmlunit:xmlunit-core:2.7.0" level="project" />
87+
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-web:2.4.1" level="project" />
88+
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-json:2.4.1" level="project" />
89+
<orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-databind:2.11.3" level="project" />
90+
<orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-annotations:2.11.3" level="project" />
91+
<orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-core:2.11.3" level="project" />
92+
<orderEntry type="library" name="Maven: com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.11.3" level="project" />
93+
<orderEntry type="library" name="Maven: com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.11.3" level="project" />
94+
<orderEntry type="library" name="Maven: com.fasterxml.jackson.module:jackson-module-parameter-names:2.11.3" level="project" />
95+
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-tomcat:2.4.1" level="project" />
96+
<orderEntry type="library" name="Maven: org.apache.tomcat.embed:tomcat-embed-core:9.0.41" level="project" />
97+
<orderEntry type="library" name="Maven: org.glassfish:jakarta.el:3.0.3" level="project" />
98+
<orderEntry type="library" name="Maven: org.apache.tomcat.embed:tomcat-embed-websocket:9.0.41" level="project" />
99+
<orderEntry type="library" name="Maven: org.springframework:spring-web:5.3.2" level="project" />
100+
<orderEntry type="library" name="Maven: org.springframework:spring-webmvc:5.3.2" level="project" />
101+
<orderEntry type="library" name="Maven: org.springframework:spring-aop:5.3.2" level="project" />
102+
<orderEntry type="library" name="Maven: org.springframework:spring-context:5.3.2" level="project" />
103+
<orderEntry type="library" name="Maven: org.springframework:spring-expression:5.3.2" level="project" />
104+
<orderEntry type="library" name="Maven: com.alibaba:fastjson:1.2.24" level="project" />
105+
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-devtools:2.4.1" level="project" />
106+
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot:2.4.1" level="project" />
107+
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-autoconfigure:2.4.1" level="project" />
108+
</component>
109+
</module>

‎media/16254538162708.jpg‎

723 KB
Loading

‎pom.xml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
4+
<modelVersion>4.0.0</modelVersion>
5+
<parent>
6+
<groupId>org.springframework.boot</groupId>
7+
<artifactId>spring-boot-starter-parent</artifactId>
8+
<version>2.4.1</version>
9+
<relativePath/>
10+
</parent>
11+
12+
<groupId>com.best</groupId>
13+
<artifactId>hello</artifactId>
14+
<version>0.0.1-SNAPSHOT</version>
15+
<name>hello java sec</name>
16+
<description>Java Sec</description>
17+
<packaging>jar</packaging>
18+
19+
<properties>
20+
<java.version>1.8</java.version>
21+
</properties>
22+
23+
<dependencies>
24+
<dependency>
25+
<groupId>org.springframework.boot</groupId>
26+
<artifactId>spring-boot-starter-jdbc</artifactId>
27+
</dependency>
28+
29+
<!-- thymeleaf模版 -->
30+
<dependency>
31+
<groupId>org.springframework.boot</groupId>
32+
<artifactId>spring-boot-starter-thymeleaf</artifactId>
33+
</dependency>
34+
35+
<!-- velocity模版 -->
36+
<dependency>
37+
<groupId>org.apache.velocity</groupId>
38+
<artifactId>velocity</artifactId>
39+
<version>1.7</version>
40+
</dependency>
41+
42+
<!-- mybatis -->
43+
<dependency>
44+
<groupId>org.mybatis.spring.boot</groupId>
45+
<artifactId>mybatis-spring-boot-starter</artifactId>
46+
<version>2.1.4</version>
47+
</dependency>
48+
49+
<!-- mysql -->
50+
<dependency>
51+
<groupId>mysql</groupId>
52+
<artifactId>mysql-connector-java</artifactId>
53+
<scope>runtime</scope>
54+
</dependency>
55+
56+
<!-- spring boot-->
57+
<dependency>
58+
<groupId>org.springframework.boot</groupId>
59+
<artifactId>spring-boot-starter-test</artifactId>
60+
<scope>test</scope>
61+
</dependency>
62+
63+
<dependency>
64+
<groupId>org.springframework.boot</groupId>
65+
<artifactId>spring-boot-starter-web</artifactId>
66+
</dependency>
67+
68+
<!-- 处理json数据, Fastjson 1.2.24存在rce漏洞 -->
69+
<dependency>
70+
<groupId>com.alibaba</groupId>
71+
<artifactId>fastjson</artifactId>
72+
<version>1.2.24</version>
73+
</dependency>
74+
75+
<!-- 热启动 -->
76+
<dependency>
77+
<groupId>org.springframework.boot</groupId>
78+
<artifactId>spring-boot-devtools</artifactId>
79+
<optional>true</optional>
80+
</dependency>
81+
82+
</dependencies>
83+
84+
<build>
85+
<plugins>
86+
<plugin>
87+
<groupId>org.springframework.boot</groupId>
88+
<artifactId>spring-boot-maven-plugin</artifactId>
89+
</plugin>
90+
</plugins>
91+
</build>
92+
93+
</project>

‎src/main/java/com/best/hello/HelloApplication.java‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
package com.best.hello;
2+
3+
import org.springframework.boot.SpringApplication;
4+
import org.springframework.boot.autoconfigure.SpringBootApplication;
5+
6+
/* Spring Boot 启动类 */
7+
@SpringBootApplication
8+
public class HelloApplication {
9+
10+
/* main方法，程序执行入口 */
11+
public static void main(String[] args) {
12+
SpringApplication.run(HelloApplication.class, args);
13+
}
14+
15+
}

‎src/main/java/com/best/hello/controller/Fastjson.java‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
package com.best.hello.controller;
2+
3+
import com.alibaba.fastjson.JSON;
4+
import com.alibaba.fastjson.JSONObject;
5+
import org.springframework.stereotype.Controller;
6+
import org.springframework.web.bind.annotation.RequestBody;
7+
import org.springframework.web.bind.annotation.RequestMapping;
8+
import org.springframework.web.bind.annotation.RequestMethod;
9+
import org.springframework.web.bind.annotation.RestController;
10+
11+
/*
12+
* Fastjson 是一个 Java 库，可以将 Java 对象转换为 JSON 格式，当然它也可以将 JSON 字符串转换为 Java 对象
13+
* Github：https://github.com/alibaba/fastjson/wiki/Quick-Start-CN
14+
*
15+
*/
16+
17+
@RestController
18+
public class Fastjson {
19+
20+
@RequestMapping(value = "/fastjson", method = {RequestMethod.POST})
21+
/*
22+
* @RequestBody 接收的参数来自请求body中，
23+
* 就application/json类型的数据而言，使用注解@RequestBody可以将body里面所有的json数据传到后端，后端再进行解析。
24+
*
25+
* 触发条件：Fastjson版本小于等于1.2.24、Java版本小于8u121
26+
*/
27+
public String rce(@RequestBody String params) {
28+
29+
try {
30+
// 转换成object
31+
JSONObject json_ob = JSON.parseObject(params);
32+
System.out.println(json_ob);
33+
34+
// 获取ob中name字段;
35+
return json_ob.get("name").toString();
36+
37+
} catch (Exception e) {
38+
return e.toString();
39+
}
40+
}
41+
42+
}

‎src/main/java/com/best/hello/controller/GetIP.java‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
package com.best.hello.controller;
2+
3+
import org.springframework.web.bind.annotation.RequestMapping;
4+
import org.springframework.web.bind.annotation.RestController;
5+
6+
import javax.servlet.http.HttpServletRequest;
7+
8+
9+
@RestController
10+
@RequestMapping("/GetIP")
11+
public class GetIP {
12+
/*
13+
* 没有使用代理的情况下，直接从 getRemoteAddr() 获取目标真实IP
14+
* 使用反向代理的情况下，由于在客户端和服务之间增加了中间层，因此服务器无法直接拿到客户端的 IP，这时取 X-Forwarded-For 中第一个IP得到的确实为客户端真实IP
15+
* 伪造添加xxf时，每个xxf在后面追加
16+
*/
17+
@RequestMapping("/remote")
18+
public static String remote(HttpServletRequest request) {
19+
// 当使用 nginx 做反向代理时，通过 HttpServletRequest 的 getRemoteAddr() 得到的是最后一个代理所在机器的IP
20+
return request.getRemoteAddr();
21+
}
22+
23+
@RequestMapping("/xxf")
24+
public static String xxf(HttpServletRequest request) {
25+
String ip1 = request.getHeader("X-Real-IP");
26+
String ip2 = request.getHeader("X-Forwarded-For");
27+
return "X-Real-IP: " + ip1 + " X-Forwarded-For: " + ip2;
28+
}
29+
30+
// 获取真实ip
31+
@RequestMapping("/realIp")
32+
public static String ip(HttpServletRequest request) {
33+
String ip1 = request.getRemoteAddr();
34+
String ip2 = request.getHeader("X-Real-IP");
35+
String ip3 = request.getHeader("X-Forwarded-For");
36+
37+
if (ip1 != null) {
38+
return ip1;
39+
} else if (ip2 != null) {
40+
return ip2;
41+
} else {
42+
return ip3;
43+
}
44+
45+
}
46+
}

0 commit comments

Comments
 (0)