Skip to content

Commit 4a87812

Browse files
j3ers3j3ers3
committed
💥 Java Sec
1 parent 68bb5c4 commit 4a87812

File tree

17 files changed

+878
-92
lines changed

17 files changed

+878
-92
lines changed

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
- [x] SSRF
1717
- [x] Directory Traversal
1818
- [x] Redirect
19-
- [ ] CSRF
19+
- [x] CSRF
2020
- [x] File Upload
2121
- [x] XXE
2222
- [x] Actuator
@@ -27,13 +27,13 @@
2727
- [x] Dos
2828
- [x] Xpath
2929
- [x] Jwt
30-
- [ ] more
30+
- [ ] more and more
3131

3232
![](media/16304936834843.jpg)
3333

3434
## Run
3535
### IDEA
36-
配置数据库连接，数据库文件`db.sql`
36+
配置数据库连接，数据库文件`src/main/resources/db.sql`
3737
```
3838
spring.datasource.url=jdbc:mysql://127.0.0.1:3306/test
3939
spring.datasource.username=root

‎pom.xml‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111

1212
<groupId>com.best</groupId>
1313
<artifactId>javasec</artifactId>
14-
<version>1.10</version>
14+
<version>1.11</version>
1515
<name>hello java sec</name>
1616
<description>Java Sec</description>
1717
<packaging>jar</packaging>
@@ -149,7 +149,7 @@
149149
<dependency>
150150
<groupId>org.jsoup</groupId>
151151
<artifactId>jsoup</artifactId>
152-
<version>1.12.2</version>
152+
<version>1.15.4</version>
153153
</dependency>
154154

155155
<!-- LDAP -->
@@ -211,6 +211,12 @@
211211
<version>2.2.0.0</version>
212212
</dependency>
213213

214+
<dependency>
215+
<groupId>org.owasp.encoder</groupId>
216+
<artifactId>encoder</artifactId>
217+
<version>1.2.3</version>
218+
</dependency>
219+
214220
<!-- log4Shell -->
215221
<dependency>
216222
<groupId>org.apache.logging.log4j</groupId>
@@ -275,6 +281,19 @@
275281
<version>0.9.5.2</version>
276282
</dependency>
277283

284+
<dependency>
285+
<groupId>org.apache.commons</groupId>
286+
<artifactId>commons-csv</artifactId>
287+
<version>1.9.0</version>
288+
</dependency>
289+
290+
<!-- 解决JDK高版本JAXB API依赖缺失 -->
291+
<dependency>
292+
<groupId>javax.xml.bind</groupId>
293+
<artifactId>jaxb-api</artifactId>
294+
<version>2.3.1</version>
295+
</dependency>
296+
278297
</dependencies>
279298

280299

‎src/main/java/com/best/hello/config/MvcConfig.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,8 @@ public void addViewControllers(ViewControllerRegistry registry) {
1212
registry.addViewController("/").setViewName("index");
1313
registry.addViewController("/login").setViewName("login");
1414
registry.addViewController("/index").setViewName("index");
15-
registry.addViewController("/index/xss").setViewName("xss");
15+
registry.addViewController("/index/xss").setViewName("xss_reflect");
16+
registry.addViewController("/index/xss/store").setViewName("xss_store");
1617
registry.addViewController("/index/rce").setViewName("rce");
1718
registry.addViewController("/index/spel").setViewName("spel");
1819
registry.addViewController("/index/ssti").setViewName("ssti");
@@ -40,6 +41,7 @@ public void addViewControllers(ViewControllerRegistry registry) {
4041
registry.addViewController("/index/swagger").setViewName("swagger");
4142
registry.addViewController("/index/jwt").setViewName("jwt");
4243
registry.addViewController("/index/xpath").setViewName("xpath");
44+
registry.addViewController("/index/csv").setViewName("csv_injection");
4345

4446
}
4547

‎src/main/java/com/best/hello/controller/CSRF.java‎

Lines changed: 79 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,89 @@
11
package com.best.hello.controller;
22

33
import io.swagger.annotations.Api;
4-
import org.springframework.web.bind.annotation.RequestMapping;
5-
import org.springframework.web.bind.annotation.RestController;
4+
import io.swagger.annotations.ApiOperation;
5+
import org.springframework.ui.Model;
6+
import org.springframework.web.bind.annotation.*;
7+
8+
import javax.servlet.http.HttpServletRequest;
9+
import javax.servlet.http.HttpServletResponse;
10+
import javax.servlet.http.HttpSession;
11+
import java.util.HashMap;
12+
import java.util.Map;
13+
import java.util.UUID;
614

715
@Api("跨站请求伪造")
816
@RestController
917
@RequestMapping("/CSRF")
1018
public class CSRF {
19+
@ApiOperation(value = "vul: 危险的转账")
20+
@GetMapping("/transfer/vul")
21+
public Map<String, Object> transferMoney(HttpServletRequest request, HttpServletResponse response, HttpSession session) {
22+
// 从请求中获取转账金额和接收者
23+
String from = (String) session.getAttribute("LoginUser");
24+
String amount = request.getParameter("amount");
25+
String receiver = request.getParameter("receiver");
26+
27+
Map<String, Object> result = new HashMap<>();
28+
result.put("from", from);
29+
result.put("receiver", receiver);
30+
result.put("amount", amount);
31+
result.put("success", true);
32+
return result;
33+
}
34+
35+
@ApiOperation(value = "vul: referer绕过", notes = "通过referer限制，只允许本站发起的请求，但是referer可以伪造")
36+
@GetMapping("/transfer/referer")
37+
public Map<String, Object> transferMoneySafe(HttpServletRequest request, HttpServletResponse response, HttpSession session) {
38+
String from = (String) session.getAttribute("LoginUser");
39+
String amount = request.getParameter("amount");
40+
String receiver = request.getParameter("receiver");
41+
Map<String, Object> result = new HashMap<>();
42+
// 校验Referer 判断请求是否来自本站
43+
String referer = request.getHeader("referer");
44+
if (referer == null || !referer.startsWith("http://baidu.com")) {
45+
result.put("success", false);
46+
result.put("message", "referer is not valid");
47+
return result;
48+
}
49+
result.put("from", from);
50+
result.put("receiver", receiver);
51+
result.put("amount", amount);
52+
result.put("success", true);
53+
return result;
54+
}
55+
56+
@GetMapping("/transfer/genCSRFToken")
57+
public Map<String, Object> genCSRFToken(HttpSession session, Model model) {
58+
String token = UUID.randomUUID().toString();
59+
session.setAttribute("csrfToken", token);
60+
Map<String, Object> result = new HashMap<>();
61+
result.put("csrfToken", token);
62+
return result;
63+
}
64+
65+
@PostMapping("/transfer/doTransferToken")
66+
public Map<String, Object> doTransferToken(HttpServletRequest request, HttpSession session) {
67+
String token = request.getParameter("csrfToken");
68+
String sessionToken = (String) session.getAttribute("csrfToken");
69+
String from = (String) session.getAttribute("LoginUser");
70+
String amount = request.getParameter("amount");
71+
String receiver = request.getParameter("receiver");
72+
Map<String, Object> result = new HashMap<>();
73+
74+
// 校验CSRF Token
75+
if (!token.equals(sessionToken)) {
76+
result.put("success", false);
77+
result.put("message", "token is not valid");
78+
return result;
79+
}
80+
81+
result.put("from", from);
82+
result.put("receiver", receiver);
83+
result.put("amount", amount);
84+
result.put("csrfToken", token);
85+
result.put("success", true);
86+
return result;
87+
}
1188

1289
}

‎src/main/java/com/best/hello/controller/CSVInjection.java‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
package com.best.hello.controller;
2+
3+
import com.best.hello.entity.XSSEntity;
4+
import com.best.hello.mapper.XSSMapper;
5+
import io.swagger.annotations.Api;
6+
import org.apache.commons.csv.CSVFormat;
7+
import org.apache.commons.csv.CSVPrinter;
8+
import org.springframework.beans.factory.annotation.Autowired;
9+
import org.springframework.web.bind.annotation.GetMapping;
10+
import org.springframework.web.bind.annotation.PostMapping;
11+
import org.springframework.web.bind.annotation.RequestMapping;
12+
import org.springframework.web.bind.annotation.RestController;
13+
14+
import javax.servlet.http.HttpServletRequest;
15+
import javax.servlet.http.HttpServletResponse;
16+
import javax.servlet.http.HttpSession;
17+
import java.io.IOException;
18+
import java.text.SimpleDateFormat;
19+
import java.util.Date;
20+
import java.util.List;
21+
22+
@Api("CSV注入漏洞")
23+
@RestController
24+
@RequestMapping("/CSVInjection")
25+
public class CSVInjection {
26+
@Autowired
27+
private XSSMapper xssMapper;
28+
29+
@PostMapping("/save")
30+
public String save(HttpServletRequest request, HttpSession session) {
31+
String content = request.getParameter("content");
32+
SimpleDateFormat df = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
33+
String date = df.format(new Date());
34+
String user = session.getAttribute("LoginUser").toString();
35+
xssMapper.add(user, content, date);
36+
return "success";
37+
}
38+
39+
@GetMapping("/getData")
40+
public List getData() {
41+
return xssMapper.list();
42+
}
43+
44+
@GetMapping("/delete")
45+
public String delete(int id) {
46+
xssMapper.deleteFeedById(id);
47+
return "success";
48+
}
49+
50+
@GetMapping("/exportVul")
51+
public void exportVul(HttpServletResponse response) throws Exception {
52+
exportCSV(response, false);
53+
}
54+
55+
@GetMapping("/exportSafe")
56+
public void exportSafe(HttpServletResponse response) throws Exception {
57+
exportCSV(response, true);
58+
}
59+
60+
/**
61+
* 导出 CSV 文件
62+
*/
63+
private void exportCSV(HttpServletResponse response, boolean safe) throws IOException {
64+
List<XSSEntity> data = xssMapper.list();
65+
66+
String fileName = "csv_injection.csv";
67+
response.setContentType("text/csv");
68+
response.setHeader("Content-Disposition", "attachment; filename=" + fileName);
69+
70+
CSVPrinter csvPrinter = new CSVPrinter(response.getWriter(), CSVFormat.DEFAULT
71+
.withHeader("ID", "用户名", "内容", "时间"));
72+
73+
for (XSSEntity x : data) {
74+
String content = safe ? filterCSVInjection(x.getContent()) : x.getContent();
75+
csvPrinter.printRecord(x.getId(), x.getUser(), content, x.getDate());
76+
}
77+
csvPrinter.flush();
78+
}
79+
80+
private String filterCSVInjection(String input) {
81+
// 定义需要过滤的特殊字符
82+
String[] forbiddenChars = {"=", "+", "-", "@"};
83+
84+
// 遍历特殊字符，将其替换为空字符串
85+
for (String forbiddenChar : forbiddenChars) {
86+
input = input.replace(forbiddenChar, "");
87+
}
88+
89+
return input;
90+
}
91+
92+
93+
}

0 commit comments

Comments
 (0)