Skip to content

Commit b8017f0

Browse files
tangxiaofeng7tangxiaofeng7
committed
add spel
1 parent 7acf054 commit b8017f0

File tree

9 files changed

+109
-35
lines changed

9 files changed

+109
-35
lines changed

‎README.md‎

Lines changed: 14 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2,44 +2,40 @@
22
<div align="center">
33

44
![SecExample](https://socialify.git.ci/tangxiaofeng7/SecExample/image?description=1&descriptionEditable=Vulnerability%20environment%20for%20Java&font=Raleway&forks=1&issues=1&pattern=Overlapping%20Hexagons&stargazers=1&theme=Dark)
5-
Use secexample to study Web security vulnerabilities
5+
JAVA 漏洞靶场
66
<br>
77
https://github.com/tangxiaofeng7/SecExample
88
<br>
99
</div>
1010

1111

12-
# Introduce
12+
# 介绍
1313
| Name | Star |
1414
| ---------------------- | ---- |
15-
| [SQLI] | 🌟🌟 |
16-
| [XSS] | 🌟 |
17-
| [CSRF] | 🌟 |
18-
| [SSRF] | 🌟🌟 |
19-
| [CORS] | 🌟🌟 |
20-
| [RCE] | 🌟🌟 |
21-
| [Fastjson] | 🌟🌟🌟🌟 |
22-
| [Verification] | 🌟🌟 |
15+
| [注入漏洞-SQL注入] | 🌟🌟🌟 |
16+
| [注入漏洞-命令注入] | 🌟 |
17+
| [注入漏洞-spel表达式注入] | 🌟🌟🌟 |
18+
| [XSS漏洞] | 🌟 |
19+
| [CSRF漏洞] | 🌟🌟 |
20+
| [SSRF漏洞] | 🌟🌟 |
21+
| [CORS漏洞] | 🌟🌟🌟🌟 |
22+
| [反序列化漏洞-Fastjson反序列化] | 🌟🌟🌟🌟 |
23+
| [验证码相关漏洞] | 🌟🌟 |
2324

2425

25-
### Installation
26+
### 安装
2627

2728
```
2829
git clone https://github.com/tangxiaofeng7/SecExample.git
2930
cd SecExample
3031
docker-compose up -d
3132
```
3233

33-
view: http://localhost:8080
34+
访问: http://localhost:8080
3435

3536
[![asciicast](https://asciinema.org/a/gcuay3zNoRUZ85BTPgjpGukuC.svg)](https://asciinema.org/a/gcuay3zNoRUZ85BTPgjpGukuC)
3637

3738

38-
### Screenshot
39+
### 截图
3940

4041
![index.png](images/index.png)
41-
42-
# Contributors
43-
44-
<a href="https://github.com/tangxiaofeng7" target="_blank">
45-
<img width=50 src="https://avatars.githubusercontent.com/u/45926593?s=60&v=4"></a>

‎images/index.png‎

-237 KB
Loading

‎src/main/java/com/suyu/secexample/rce/controller/rcecontroller.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@ public String input(){
2323

2424
@PostMapping("/rceoutput")
2525
public String index(@RequestParam("command") String command, Model model){
26+
if(command=="" | command==null){
27+
command= "whoami";
28+
}
2629
Process p = null;
2730
String result = null;
2831
try {

‎src/main/java/com/suyu/secexample/xxe/controller/xxecontroller.java‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
package com.suyu.secexample.xxe.controller;
2+
3+
import org.springframework.stereotype.Controller;
4+
import org.springframework.web.bind.annotation.GetMapping;
5+
6+
@Controller
7+
public class xxecontroller {
8+
9+
@GetMapping("/xxe")
10+
public String input(){
11+
return "xxe/xxe";
12+
}
13+
14+
}

‎src/main/resources/application.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ spring:
22
datasource:
33
username: root
44
password: woaini520
5-
# url: jdbc:mysql://localhost:3306/mybatis?serverTimezone=UTC&useSSL=false
6-
url: jdbc:mysql://mysql-db:3306/mybatis?serverTimezone=UTC&useSSL=false&allowPublicKeyRetrieval=true
5+
url: jdbc:mysql://localhost:3306/mybatis?serverTimezone=UTC&useSSL=false
6+
# url: jdbc:mysql://mysql-db:3306/mybatis?serverTimezone=UTC&useSSL=false&allowPublicKeyRetrieval=true
77
# driver-class-name: com.mysql.jdbc.Driver
88
driver-class-name: com.mysql.cj.jdbc.Driver
99
# thymeleaf:

‎src/main/resources/templates/index.html‎

Lines changed: 23 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -24,63 +24,73 @@ <h1>Java漏洞演示平台</h1>
2424
<div class="description">SQL注入通过把SQL命令插入到Web表单提交或输入域名或页面请求的查询字符串，最终达到欺骗服务器执行指定的SQL语句</div>
2525
</div>
2626
<a class="ui bottom attached button" th:href="@{/sql}" ><i class="add icon"></i>测试漏洞</a>
27+
</div>
2728

29+
<div class="card">
30+
<div class="content">
31+
<div class="header">注入漏洞-命令注入</div>
32+
<div class="description">RCE (remote code execution):指用户通过浏览器提交执行命令，由于服务器端没有针对执行函数做过滤，导致在没有指定绝对路径的情况下就执行命令，可能会允许攻击者通过改变 $PATH 或程序执行环境的其他方面来执行一个恶意构造的代码。</div>
33+
</div>
34+
<a class="ui bottom attached button" th:href="@{/rce}" ><i class="add icon"></i>测试漏洞</a>
35+
</div>
36+
37+
<div class="card">
38+
<div class="content">
39+
<div class="header">注入漏洞-spel表达式注入</div>
40+
<div class="description">spel表达式注入 (Spring Expression Language):是一种功能强大的表达式语言，用于在运行时查询和操作对象图；语法上称为Unified EL，但提供了更多的特性，特别是方法调用和基本字符SpEL的生成是为了给Spring社区提供一种能够与Spring生态系统所有产品无缝对接，能提供一站式支持的表达式语言。</div>
41+
</div>
42+
<a class="ui bottom attached button" th:href="@{/spel}" ><i class="add icon"></i>测试漏洞</a>
2843
</div>
2944
<div class="card">
3045
<div class="content">
3146
<div class="header">XSS漏洞</div>
3247
<div class="description">XSS(Cross Site Scripting):跨站脚本攻击是指恶意攻击者往Web页面里插入恶意Script代码,当用户浏览该页之时,嵌入其中Web里面的Script代码会被执行,从而达到恶意攻击用户的目的</div>
3348
</div>
3449
<a class="ui bottom attached button" th:href="@{/xss}" ><i class="add icon"></i>测试漏洞</a>
35-
3650
</div>
51+
3752
<div class="card">
3853
<div class="content">
3954
<div class="header">CSRF漏洞</div>
4055
<div class="description">CSRF(Cross-site request forgery):CSRF，跨站请求伪造，在受害者通过浏览器登录某个恶意URL的时候，通过伪造请求达到跨站请求伪造（常见于商城类网站或者自己开发的会员系统）</div>
4156
</div>
4257
<a class="ui bottom attached button" th:href="@{/csrf}" ><i class="add icon"></i>测试漏洞</a>
43-
4458
</div>
59+
4560
<div class="card">
4661
<div class="content">
4762
<div class="header">SSRF漏洞</div>
4863
<div class="description">SSRF(Server-Side Request Forgery):服务器端请求伪造是一种由攻击者构造形成由服务端发起请求的一个安全漏洞。一般情况下，SSRF攻击的目标是从外网无法访问的内部系统。</div>
4964
</div>
5065
<a class="ui bottom attached button" th:href="@{/ssrf}" ><i class="add icon"></i>测试漏洞</a>
51-
5266
</div>
67+
5368
<div class="card">
5469
<div class="content">
5570
<div class="header">CORS漏洞</div>
56-
<div class="description">CORS(Cross-origin resource sharing)。因为出于安全的考虑, 浏览器不允许Ajax调用当前源之外的资源.，即浏览器的同源策略，但一个请求url的协议、域名、端口三者之间任意一个与当前页面不同即为跨域、它允许阅览器向跨源服务器发送XMLHttpRequest请求，从而克服AJAX只能同源使用的限制
57-
</div>
71+
<div class="description">CORS(Cross-origin resource sharing)。因为出于安全的考虑, 浏览器不允许Ajax调用当前源之外的资源.，即浏览器的同源策略，但一个请求url的协议、域名、端口三者之间任意一个与当前页面不同即为跨域、它允许阅览器向跨源服务器发送XMLHttpRequest请求，从而克服AJAX只能同源使用的限制</div>
5872
</div>
5973
<a class="ui bottom attached button" th:href="@{/cors1}" ><i class="add icon"></i>测试漏洞</a>
60-
6174
</div>
62-
<div class="card">
63-
<div class="content">
64-
<div class="header">RCE漏洞</div>
65-
<div class="description">RCE (remote code execution):指用户通过浏览器提交执行命令，由于服务器端没有针对执行函数做过滤，导致在没有指定绝对路径的情况下就执行命令，可能会允许攻击者通过改变 $PATH 或程序执行环境的其他方面来执行一个恶意构造的代码。</div>
66-
</div>
67-
<a class="ui bottom attached button" th:href="@{/rce}" ><i class="add icon"></i>测试漏洞</a>
6875

69-
</div>
7076
<div class="card">
7177
<div class="content">
7278
<div class="header">反序列化漏洞-Fastjson反序列化</div>
7379
<div class="description">序列化和反序列化本身并不存在问题。但当输入的反序列化的数据可被用户控制，那么攻击者即可通过构造恶意输入，让反序列化产生非预期的对象，在此过程中执行构造的任意代码。</div>
7480
</div>
7581
<a class="ui bottom attached button" th:href="@{/fastjson}" ><i class="add icon"></i>测试漏洞</a>
7682
</div>
83+
84+
85+
7786
<div class="card">
7887
<div class="content">
7988
<div class="header">验证码相关漏洞</div>
8089
<div class="description">短信回显<br>短信轰炸<br>前端绕过验证<br>验证码爆破</div>
8190
</div>
8291
<a class="ui bottom attached button" th:href="@{/messageecho}" ><i class="add icon"></i>测试漏洞</a>
8392
</div>
93+
8494
</div>
8595

8696

‎src/main/resources/templates/spel/spel.html‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<!DOCTYPE html>
2+
<html lang="en" xmlns:th="http://www.thymeleaf.org">
3+
<head>
4+
<meta charset="UTF-8">
5+
<title>Java漏洞靶场</title>
6+
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/semantic.min.css">
7+
</head>
8+
<body>
9+
10+
<div style="padding: 40px;
11+
text-align: center;
12+
background: #1abc9c;
13+
color: white;">
14+
<h1>Java漏洞演示平台</h1>
15+
<button class="ui inverted secondary basic button"><a style="color: white" th:href="home">回到首页</a></button>
16+
</div>
17+
18+
<form th:action="@{/speloutput}" method="post" style="text-align: center;margin: 0px auto;
19+
margin-top: 50px;" border="10">
20+
<input type="text" name="selector" placeholder="请输入用户名查找">
21+
<input type="submit" value="提交">
22+
<p></p>
23+
<p>提示：T(java.lang.Runtime).getRuntime().exec('open -a Calculator.app')</p>
24+
</form>
25+
26+
27+
</body>
28+
</html>

‎src/main/resources/templates/spel/speloutput.html‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<!DOCTYPE html>
2+
<html lang="en" xmlns:th="http://www.thymeleaf.org">
3+
<head>
4+
<meta charset="UTF-8">
5+
<title>Java漏洞靶场</title>
6+
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/semantic.min.css">
7+
</head>
8+
<body>
9+
10+
<div style="padding: 40px;
11+
text-align: center;
12+
background: #1abc9c;
13+
color: white;">
14+
<h1>Java漏洞演示平台</h1>
15+
<button class="ui inverted secondary basic button"><a style="color: white" th:href="home">回到首页</a></button>
16+
</div>
17+
<div style="text-align: center;margin: 0px auto;
18+
margin-top: 50px;">
19+
您请求的结果为：<p th:text="${selector}"></p>
20+
</div>
21+
</body>
22+
</html>

‎src/main/resources/templates/ssrf/ssrfoutput.html‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,9 @@ <h1>Java漏洞演示平台</h1>
1515
<button class="ui inverted secondary basic button"><a style="color: white" th:href="home">回到首页</a></button>
1616
</div>
1717

18-
18+
<div style="text-align: center;margin: 0px auto;
19+
margin-top: 50px;">
1920
您请求的结果为：<p th:text="${result}"></p>
20-
21+
</div>
2122
</body>
2223
</html>

0 commit comments

Comments
 (0)