🍺 Java Sec

Author: j3ers3

README.md

@@ -1,30 +1,46 @@
-# Hello Java Sec 
+# ☕️ Hello Java Sec ![Stage](https://img.shields.io/badge/Release-DEV-brightgreen.svg)
 > 学习 Java 漏洞，记录一下代码
 
-![](media/16254538162708.jpg)
+![](media/16261597400147.jpg)
 
 
+- 默认账号：admin/admin
+
 ## Vulnerability
 - [ ] SQLi
 - [x] XSS
 - [x] RCE
 - [x] SSTI
 - [x] SpEL
-- [ ] SSRF
+- [x] SSRF
 - [ ] Directory Traversal
-- [ ] Redirect
+- [x] Redirect
 - [ ] CSRF
 - [ ] File Upload
 - [ ] XXE
+- [x] Actuator
 - [ ] Fastjson
 
 ## Run
 ### IDEA
-配置环境run即可
+配置数据库连接，数据库文件`db.sql`
+```
+spring.datasource.url=jdbc:mysql://127.0.0.1:3306/test
+spring.datasource.username=root
+spring.datasource.password=1234567
+```
 
 ### Jar
 ```
 git clone https://github.com/j3ers3/Hello-Java-Sec
 mvn clean package -DskipTests
 java -jar hello-0.0.1-SNAPSHOT.jar
-```
+```
+
+
+## 环境
+- Java 1.8
+- SpringBoot 4.0
+- Bootstrap 4.6.0
+- Codemirror 5.62.0
+- Fastjson 1.2.24

hello.iml

@@ -105,5 +105,13 @@
     <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-devtools:2.4.1" level="project" />
     <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot:2.4.1" level="project" />
     <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-autoconfigure:2.4.1" level="project" />
+    <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-actuator:2.4.1" level="project" />
+    <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-actuator-autoconfigure:2.4.1" level="project" />
+    <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-actuator:2.4.1" level="project" />
+    <orderEntry type="library" name="Maven: io.micrometer:micrometer-core:1.6.2" level="project" />
+    <orderEntry type="library" name="Maven: org.hdrhistogram:HdrHistogram:2.1.12" level="project" />
+    <orderEntry type="library" scope="RUNTIME" name="Maven: org.latencyutils:LatencyUtils:2.0.3" level="project" />
+    <orderEntry type="library" name="Maven: org.jolokia:jolokia-core:1.4.0" level="project" />
+    <orderEntry type="library" name="Maven: com.googlecode.json-simple:json-simple:1.1.1" level="project" />
   </component>
 </module>

media/16254538162708.jpg

@@ -79,6 +79,19 @@
             <optional>true</optional>
         </dependency>
 
+        <!-- actuator监控 -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.jolokia</groupId>
+            <artifactId>jolokia-core</artifactId>
+            <version>1.4.0</version>
+        </dependency>
+
+
     </dependencies>
 
     <build>

media/16261597400147.jpg

@@ -0,0 +1,16 @@
+package com.best.hello.Dao;
+
+public class User {
+    private Integer id;
+    private String user;
+    private String pass;
+
+    public Integer getId() {
+        return id;
+    }
+
+    public String getUser() {
+        return user;
+    }
+
+}

pom.xml

@@ -0,0 +1,22 @@
+package com.best.hello.config;
+
+import org.springframework.web.servlet.HandlerInterceptor;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class LoginHandlerInterceptor implements HandlerInterceptor {
+    @Override
+    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
+        //用户登录成功后,应该有自己的session
+        Object session = request.getSession().getAttribute("LoginUser");
+        System.out.println("[*] session用户：" + session);
+        if (session == null) {
+            request.setAttribute("msg", "请先登录");
+            request.getRequestDispatcher("/login").forward(request, response);
+            return false;
+        } else {
+            return true;
+        }
+    }
+}

src/main/java/com/best/hello/Dao/User.java

@@ -0,0 +1,37 @@
+package com.best.hello.config;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+/**
+ * 视图跳转
+ */
+@Configuration
+public class MyMvcConfig implements WebMvcConfigurer {
+    @Override
+    public void addViewControllers(ViewControllerRegistry registry) {
+        registry.addViewController("/").setViewName("index");
+        registry.addViewController("/index").setViewName("index");
+        registry.addViewController("/login").setViewName("login");
+        registry.addViewController("/index/xss").setViewName("xss");
+        registry.addViewController("/index/rce").setViewName("rce");
+        registry.addViewController("/index/spel").setViewName("spel");
+        registry.addViewController("/index/ssti").setViewName("ssti");
+        registry.addViewController("/index/sqli").setViewName("sqli");
+        registry.addViewController("/index/ssrf").setViewName("ssrf");
+        registry.addViewController("/index/ssrf").setViewName("ssrf");
+
+    }
+
+    /**
+     * 拦截器，判断是否登录成功
+     */
+    @Override
+    public void addInterceptors(InterceptorRegistry registry) {
+        registry.addInterceptor(new LoginHandlerInterceptor())
+                .addPathPatterns("/**")
+                .excludePathPatterns("/index", "/", "/user/login", "/login", "/css/**", "/js/**", "/img/**");
+    }
+}

src/main/java/com/best/hello/config/LoginHandlerInterceptor.java

@@ -24,17 +24,6 @@
 @Controller
 public class Index {
 
-    // 如果请求路径为index，则调用index()方法
-    @RequestMapping("/index")
-    public String index() {
-        return "index";
-    }
-
-    @RequestMapping("/login")
-    public String login() {
-        return "login";
-    }
-
     @RequestMapping("/")
     public String redirect() {
         return "redirect:/index";
@@ -45,33 +34,13 @@ public String redirect() {
     public String sysInfo() {
         Map<String, String> m = new HashMap<>();
 
+        m.put("app", "Hello Java SEC");
+        m.put("author", "nul1");
         m.put("tomcat_version", ServerInfo.getServerInfo());
-        m.put("app_name", "Java SEC");
         m.put("java_version", System.getProperty("java.version"));
         m.put("fastjson_version", JSON.VERSION);
 
         return JSON.toJSONString(m);
 
     }
-
-    @GetMapping("/index/xss")
-    public static String xss() {
-        return "xss";
-    }
-
-    @GetMapping("/index/spel")
-    public static String spel(){
-        return "spel";
-    }
-
-    @GetMapping("/index/rce")
-    public static String rce(){
-        return "rce";
-    }
-
-    @GetMapping("/index/ssti")
-    public static String ssti(){
-        return "ssti";
-    }
-
 }

src/main/java/com/best/hello/config/MyMvcConfig.java

@@ -10,12 +10,20 @@
 @Controller
 public class Login {
     @RequestMapping("/user/login")
-    public String login(@RequestParam("username") String username, @RequestParam("password") String password, Model model) {
-        if ("admin".equals(username) && "123456".equals(password))
+    public String login(@RequestParam("username") String username, @RequestParam("password") String password, Model model, HttpSession session) {
+        if ("admin".equals(username) && "admin".equals(password)){
+            session.setAttribute("LoginUser", username);
             return "redirect:/index";
-        else {
+        } else {
             model.addAttribute("msg", "用户名或者密码错误"); //显示错误信息
-            return "admin789";
+            return "login";
         }
     }
+
+    // 注销
+    @RequestMapping("/user/logout")
+    public String logout(HttpSession session) {
+        session.invalidate();
+        return "redirect:/login";
+    }
 }