Skip to content

Commit 15a99fb

Browse files
JoyChou93JoyChou93
committed
add sqli
1 parent dfc3316 commit 15a99fb

File tree

5 files changed

+225
-2
lines changed

5 files changed

+225
-2
lines changed

‎README.md‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,3 +104,83 @@ if __name__ == '__main__':
104104

105105
访问`http://localhost:8080/file/`进行文件上传，上传成功后，再访问`http://localhost:8080/image/上传的文件名`可访问上传后的文件。
106106

107+
## XXE
108+
109+
2018年08月22日更新支持XInclude的XXE漏洞代码，详情见代码。
110+
111+
POC
112+
113+
```xml
114+
<?xml version="1.0" ?>
115+
<root xmlns:xi="http://www.w3.org/2001/XInclude">
116+
<xi:include href="file:///etc/passwd" parse="text"/>
117+
</root>
118+
```
119+
120+
URL编码后
121+
122+
```
123+
http://localhost:8080/xxe/DocumentBuilder_xinclude?xml=%3C%3fxml+version%3d%221.0%22+%3f%3E%0d%0a%3Croot+xmlns%3axi%3d%22http%3a%2f%2fwww.w3.org%2f2001%2fXInclude%22%3E%0d%0a+%3Cxi%3ainclude+href%3d%22file%3a%2f%2f%2fetc%2fpasswd%22+parse%3d%22text%22%2f%3E%0d%0a%3C%2froot%3E
124+
```
125+
126+
## SQL注入
127+
128+
POC
129+
130+
```
131+
http://localhost:8080/sqli/jdbc?name=joychou' or 'a'='a
132+
```
133+
134+
返回`joychou: 123 wilson: 456 lightless: 789`
135+
136+
正常访问`http://localhost:8080/sqli/jdbc?name=joychou`，返回`joychou: 123`
137+
138+
数据库配置：
139+
140+
```sql
141+
/*
142+
Navicat Premium Data Transfer
143+
144+
Source Server : localhost
145+
Source Server Type : MySQL
146+
Source Server Version : 80012
147+
Source Host : localhost:3306
148+
Source Schema : sectest
149+
150+
Target Server Type : MySQL
151+
Target Server Version : 80012
152+
File Encoding : 65001
153+
154+
Date: 22/08/2018 21:09:57
155+
*/
156+
157+
SET NAMES utf8mb4;
158+
SET FOREIGN_KEY_CHECKS = 0;
159+
160+
-- ----------------------------
161+
-- Table structure for users
162+
-- ----------------------------
163+
DROP TABLE IF EXISTS `users`;
164+
CREATE TABLE `users` (
165+
`name` varchar(255) NOT NULL,
166+
`password` varchar(255) NOT NULL,
167+
`isAdmin` varchar(255) NOT NULL
168+
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
169+
170+
-- ----------------------------
171+
-- Records of users
172+
-- ----------------------------
173+
BEGIN;
174+
INSERT INTO `users` VALUES ('joychou', '123', '1');
175+
INSERT INTO `users` VALUES ('wilson', '456', '0');
176+
INSERT INTO `users` VALUES ('lightless', '789', '0');
177+
COMMIT;
178+
179+
SET FOREIGN_KEY_CHECKS = 1;
180+
181+
```
182+
183+
说明：
184+
185+
SQL注入修复方式采用预处理方式，修复见代码。
186+
Mybatis的`#{}`也是预处理方式处理SQL注入。

‎java-sec-code.iml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
</configuration>
1313
</facet>
1414
</component>
15-
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_8">
15+
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_6">
1616
<output url="file://$MODULE_DIR$/target/classes" />
1717
<output-test url="file://$MODULE_DIR$/target/test-classes" />
1818
<content url="file://$MODULE_DIR$">
@@ -57,6 +57,9 @@
5757
<orderEntry type="library" name="Maven: org.slf4j:slf4j-api:1.7.22" level="project" />
5858
<orderEntry type="library" name="Maven: nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect:1.4.0" level="project" />
5959
<orderEntry type="library" name="Maven: org.codehaus.groovy:groovy:2.4.7" level="project" />
60+
<orderEntry type="library" name="Maven: mysql:mysql-connector-java:8.0.12" level="project" />
61+
<orderEntry type="library" name="Maven: com.google.protobuf:protobuf-java:2.6.0" level="project" />
62+
<orderEntry type="library" name="Maven: com.alibaba:fastjson:1.2.49" level="project" />
6063
<orderEntry type="library" name="Maven: com.google.guava:guava:21.0" level="project" />
6164
<orderEntry type="library" name="Maven: commons-collections:commons-collections:3.1" level="project" />
6265
<orderEntry type="library" name="Maven: commons-lang:commons-lang:2.4" level="project" />

‎pom.xml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,20 @@
4343
<artifactId>spring-boot-starter-thymeleaf</artifactId>
4444
</dependency>
4545

46+
<!-- 处理jdbc的mysql连接-->
47+
<dependency>
48+
<groupId>mysql</groupId>
49+
<artifactId>mysql-connector-java</artifactId>
50+
<version>8.0.12</version>
51+
</dependency>
52+
53+
<!-- 处理json数据 -->
54+
<dependency>
55+
<groupId>com.alibaba</groupId>
56+
<artifactId>fastjson</artifactId>
57+
<version>1.2.49</version>
58+
</dependency>
59+
4660

4761
<dependency>
4862
<groupId>com.google.guava</groupId>

‎src/main/java/org/joychou/controller/SQLI.java‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
package org.joychou.controller;
2+
3+
4+
import org.springframework.stereotype.Controller;
5+
import org.springframework.web.bind.annotation.RequestMapping;
6+
import org.springframework.web.bind.annotation.ResponseBody;
7+
8+
import javax.servlet.http.HttpServletRequest;
9+
import java.sql.*;
10+
11+
12+
/**
13+
* Date：2018年08月22日
14+
* Author: JoyChou
15+
* Desc: SQL注入漏洞
16+
*/
17+
18+
@Controller
19+
@RequestMapping("/sqli")
20+
public class SQLI {
21+
22+
@RequestMapping("/jdbc")
23+
@ResponseBody
24+
public static String jdbc_sqli(HttpServletRequest request){
25+
26+
String name = request.getParameter("name");
27+
String driver = "com.mysql.jdbc.Driver";
28+
String url = "jdbc:mysql://localhost:3306/sectest";
29+
String user = "root";
30+
String password = "woshishujukumima";
31+
String result = "";
32+
try {
33+
Class.forName(driver);
34+
Connection con = DriverManager.getConnection(url,user,password);
35+
36+
if(!con.isClosed())
37+
System.out.println("Connecting to Database successfully.");
38+
39+
// sqli vuln code 漏洞代码
40+
Statement statement = con.createStatement();
41+
String sql = "select * from users where name = '" + name + "'";
42+
System.out.println(sql);
43+
ResultSet rs = statement.executeQuery(sql);
44+
45+
// fix code 用预处理修复SQL注入
46+
// String sql = "select * from users where name = ?";
47+
// PreparedStatement st = con.prepareStatement(sql);
48+
// st.setString(1, name);
49+
// System.out.println(st.toString()); // 预处理后的sql
50+
// ResultSet rs = st.executeQuery();
51+
52+
System.out.println("-----------------");
53+
54+
while(rs.next()){
55+
String res_name = rs.getString("name");
56+
String res_pwd = rs.getString("password");
57+
result += res_name + ": " + res_pwd + "\n";
58+
System.out.println(res_name + ": " + res_pwd);
59+
60+
}
61+
rs.close();
62+
con.close();
63+
64+
65+
}catch (ClassNotFoundException e) {
66+
System.out.println("Sorry,can`t find the Driver!");
67+
e.printStackTrace();
68+
}catch (SQLException e) {
69+
e.printStackTrace();
70+
}catch (Exception e) {
71+
e.printStackTrace();
72+
73+
}finally{
74+
System.out.println("-----------------");
75+
System.out.println("Connect database done.");
76+
}
77+
return result;
78+
}
79+
80+
}

‎src/main/java/org/joychou/controller/XXE.java‎

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44
import org.springframework.web.bind.annotation.*;
55
import javax.servlet.http.HttpServletRequest;
66
import org.w3c.dom.Document;
7+
import org.w3c.dom.Node;
8+
import org.w3c.dom.NodeList;
79
import org.xml.sax.helpers.XMLReaderFactory;
810
import org.xml.sax.XMLReader;
911
import java.io.StringReader;
@@ -32,7 +34,6 @@ public static String xxe_xmlReader(HttpServletRequest request) {
3234
String xml_con = request.getParameter("xml").toString();
3335
System.out.println(xml_con);
3436
XMLReader xmlReader = XMLReaderFactory.createXMLReader();
35-
3637
// fix code start
3738

3839
// xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
@@ -128,5 +129,50 @@ public static String xxe_DocumentBuilder(HttpServletRequest request) {
128129
}
129130

130131

132+
@RequestMapping("/DocumentBuilder_xinclude")
133+
@ResponseBody
134+
public static String xxe_xinclude_DocumentBuilder(HttpServletRequest request) {
135+
try {
136+
String xml_con = request.getParameter("xml").toString();
137+
System.out.println(xml_con);
138+
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
139+
140+
dbf.setXIncludeAware(true); // 支持XInclude
141+
dbf.setNamespaceAware(true);
142+
143+
// fix code start
144+
145+
// dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
146+
// dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
147+
// dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
148+
149+
// fix code end
150+
151+
DocumentBuilder db = dbf.newDocumentBuilder();
152+
StringReader sr = new StringReader(xml_con);
153+
InputSource is = new InputSource(sr);
154+
Document document = db.parse(is); // parse xml
155+
156+
NodeList rootNodeList = document.getChildNodes();
157+
158+
for (int i = 0; i < rootNodeList.getLength(); i++) {
159+
Node rootNode = rootNodeList.item(i);
160+
NodeList xxe = rootNode.getChildNodes();
161+
for (int j = 0; j < xxe.getLength(); j++) {
162+
Node xxeNode = xxe.item(j);
163+
System.out.println("xxeNode: " + xxeNode.getNodeValue()); // 回显
164+
}
165+
166+
}
167+
168+
sr.close();
169+
return "test";
170+
} catch (Exception e) {
171+
System.out.println(e);
172+
return "except";
173+
}
174+
}
175+
176+
131177

132178
}

0 commit comments

Comments
 (0)