🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃🎃
j3ers3 / hello-java-sec Goto Github PK
View Code? Open in Web Editor NEW☕️ Java Security,安全编码和代码审计
☕️ Java Security,安全编码和代码审计
docker部署后无法外部访问,内部可以。
查看Hello-Java-Sec\src\main\resourcesapplication.properties中:
server.address=0.0.0.0
制作一个只有admin才能访问的接口,zhangwei的session不能访问
对应的制作一个和上面功能一致但对用户session不进行任何判断的接口
让学习者可以用bp测水平越权
Error creating bean with name 'documentationPluginsBootstrapper' defined in URL [jar:file:/xxx/xxx/pringfox/springfox-spring-web/2.9.2/springfox-spring-web-2.9.2.jar!/springfox/documentation/spring/web/plugins/DocumentationPluginsBootstrapper.class]: Unsatisfied dependency expressed through constructor parameter 1; nested exception is org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'webMvcRequestHandlerProvider' defined in URL [jar:file:/D:/maven_repo/io/springfox/springfox-spring-web/2.9.2/springfox-spring-web-2.9.2.jar!/springfox/documentation/spring/web/plugins/WebMvcRequestHandlerProvider.class]: Unsatisfied dependency expressed through constructor parameter 1; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'webEndpointServletHandlerMapping' defined in class path resource [org/springframework/boot/actuate/autoconfigure/endpoint/web/servlet/WebMvcEndpointManagementContextConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.boot.actuate.endpoint.web.servlet.WebMvcEndpointHandlerMapping]: Factory method 'webEndpointServletHandlerMapping' threw exception; nested exception is org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'healthEndpoint' defined in class path resource [org/springframework/boot/actuate/autoconfigure/health/HealthEndpointConfiguration.class]: Unsatisfied dependency expressed through method 'healthEndpoint' parameter 0; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'healthContributorRegistry' defined in class path resource [org/springframework/boot/actuate/autoconfigure/health/HealthEndpointConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.boot.actuate.health.HealthContributorRegistry]: Factory method 'healthContributorRegistry' threw exception; nested exception is org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'ldapHealthContributor' defined in class path resource [org/springframework/boot/actuate/autoconfigure/ldap/LdapHealthContributorAutoConfiguration.class]: Unsatisfied dependency expressed through method 'ldapHealthContributor' parameter 0; nested exception is org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'ldapTemplate' defined in class path resource [org/springframework/boot/autoconfigure/ldap/LdapAutoConfiguration.class]: Unsatisfied dependency expressed through method 'ldapTemplate' parameter 1; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'ldapContextSource' defined in class path resource [org/springframework/boot/autoconfigure/ldap/LdapAutoConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.ldap.core.support.LdapContextSource]: Factory method 'ldapContextSource' threw exception; nested exception is java.lang.IllegalAccessError: class org.springframework.ldap.core.support.AbstractContextSource (in unnamed module @0x33d512c1) cannot access class com.sun.jndi.ldap.LdapCtxFactory (in module java.naming) because module java.naming does not export com.sun.jndi.ldap to unnamed module @0x33d512c1
D:\Hello-Java-Sec\target\classes\com\best\hello\controller\RCE\RuntimeVul.class (无法成功完成操作,因为文件包含病毒或潜在的垃圾软件。)
---> 6881a357f8b7
Successfully built 6881a357f8b7
Successfully tagged javasec:latest
f020510cc8ffd6812699b2c2c9f1ffd099aac6d95cdc151b309c40a5c3dced95
(base) zqx@ubuntu:~/Documents/Hello-Java-Sec$ docker ps
WARNING: Error loading config file: /home/zqx/.docker/config.json: open /home/zqx/.docker/config.json: permission denied
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
(base) zqx@ubuntu:~/Documents/Hello-Java-Sec$
开始是找不到jar包,然后我把下载的jar包改为javasec.jar
容器创建成功了,但是还是访问不了!
感觉师傅的ide好好看(
你的项目很有帮助,请继续更新吧
[ERROR] COMPILATION ERROR :
[INFO] -------------------------------------------------------------
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[3,33] package javax.xml.bind.annotation does not exist
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[4,33] package javax.xml.bind.annotation does not exist
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[5,33] package javax.xml.bind.annotation does not exist
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[6,33] package javax.xml.bind.annotation does not exist
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[9,2] cannot find symbol
symbol: class XmlRootElement
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[10,2] cannot find symbol
symbol: class XmlAccessorType
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/XXE.java:[20,22] package javax.xml.bind does not exist
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/XXE.java:[21,22] package javax.xml.bind does not exist
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[10,18] cannot find symbol
symbol: variable XmlAccessType
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[12,6] cannot find symbol
symbol: class XmlElement
location: class com.best.hello.controller.XXE.Student
[INFO] 10 errors
[INFO] -------------------------------------------------------------
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 3.652 s
[INFO] Finished at: 2023-02-02T10:37:31+08:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.8.1:compile (default-compile) on project javasec: Compilation failure: Compilation failure:
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[3,33] package javax.xml.bind.annotation does not exist
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[4,33] package javax.xml.bind.annotation does not exist
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[5,33] package javax.xml.bind.annotation does not exist
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[6,33] package javax.xml.bind.annotation does not exist
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[9,2] cannot find symbol
[ERROR] symbol: class XmlRootElement
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[10,2] cannot find symbol
[ERROR] symbol: class XmlAccessorType
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/XXE.java:[20,22] package javax.xml.bind does not exist
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/XXE.java:[21,22] package javax.xml.bind does not exist
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[10,18] cannot find symbol
[ERROR] symbol: variable XmlAccessType
[ERROR] /opt/Hello-Java-Sec/src/main/java/com/best/hello/controller/XXE/Student.java:[12,6] cannot find symbol
[ERROR] symbol: class XmlElement
[ERROR] location: class com.best.hello.controller.XXE.Student
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
后在release下载jar运行,也是报错
2023-02-02 10:35:11.058 ERROR 6230 --- [0.0-8888-exec-1] o.a.c.c.C.[.[.[/].[dispatcherServlet] : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Handler dispatch failed; nested exception is java.lang.NoClassDefFoundError: javax/xml/bind/DatatypeConverter] with root cause
java.lang.ClassNotFoundException: javax.xml.bind.DatatypeConverter
at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:476) ~[na:na]
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:589) ~[na:na]
at org.springframework.boot.loader.LaunchedURLClassLoader.loadClass(LaunchedURLClassLoader.java:151) ~[javasec-1.10.jar:1.10]
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522) ~[na:na]
at io.jsonwebtoken.impl.Base64Codec.decode(Base64Codec.java:26) ~[jjwt-0.9.1.jar!/:0.9.1]
at io.jsonwebtoken.impl.DefaultJwtBuilder.signWith(DefaultJwtBuilder.java:99) ~[jjwt-0.9.1.jar!/:0.9.1]
at com.best.hello.util.JwtUtils.generateToken(JwtUtils.java:38) ~[classes!/:1.10]
at com.best.hello.controller.Login.login(Login.java:38) ~[classes!/:1.10]
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:na]
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:na]
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:na]
at java.base/java.lang.reflect.Method.invoke(Method.java:566) ~[na:na]
at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:197) ~[spring-web-5.3.2.jar!/:5.3.2]
at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:141) ~[spring-web-5.3.2.jar!/:5.3.2]
at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:106) ~[spring-webmvc-5.3.2.jar!/:5.3.2]
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:894) ~[spring-webmvc-5.3.2.jar!/:5.3.2]
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:808) ~[spring-webmvc-5.3.2.jar!/:5.3.2]
at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) ~[spring-webmvc-5.3.2.jar!/:5.3.2]
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1061) ~[spring-webmvc-5.3.2.jar!/:5.3.2]
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:961) ~[spring-webmvc-5.3.2.jar!/:5.3.2]
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006) ~[spring-webmvc-5.3.2.jar!/:5.3.2]
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:909) ~[spring-webmvc-5.3.2.jar!/:5.3.2]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:652) ~[tomcat-embed-core-9.0.41.jar!/:4.0.FR]
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883) ~[spring-webmvc-5.3.2.jar!/:5.3.2]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:733) ~[tomcat-embed-core-9.0.41.jar!/:4.0.FR]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) ~[tomcat-embed-websocket-9.0.41.jar!/:9.0.41]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) ~[spring-web-5.3.2.jar!/:5.3.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.2.jar!/:5.3.2]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) ~[spring-web-5.3.2.jar!/:5.3.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.2.jar!/:5.3.2]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:93) ~[spring-boot-actuator-2.4.1.jar!/:2.4.1]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.2.jar!/:5.3.2]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) ~[spring-web-5.3.2.jar!/:5.3.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.2.jar!/:5.3.2]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:542) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:690) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:374) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:888) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1597) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~[na:na]
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~[na:na]
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) ~[tomcat-embed-core-9.0.41.jar!/:9.0.41]
at java.base/java.lang.Thread.run(Thread.java:829) ~[na:na]
2023-02-02 10:35:11.063 WARN 6230 --- [0.0-8888-exec-1] .w.s.m.s.DefaultHandlerExceptionResolver : Resolved [org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'POST' not supported]
public static boolean isIntranet(String url) {
Pattern reg = Pattern.compile("^(127\\.0\\.0\\.1)|(localhost)|(10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})|(172\\.((1[6-9])|(2\\d)|(3[01]))\\.\\d{1,3}\\.\\d{1,3})|(192\\.168\\.\\d{1,3}\\.\\d{1,3})$");
Matcher match = reg.matcher(url);
boolean a = match.find();
return a;
}
127.0.0.1匹配不到?
同时也可以ip地址转换绕过 比如127.1 或者十进制 十六进制
o.s.b.actuate.ldap.LdapHealthIndicator : LDAP health check failed
org.springframework.ldap.CommunicationException: localhost:389; nested exception is javax.naming.CommunicationException: localhost:389 [Root exception is java.net.ConnectException: Connection refused: connect]
at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:108) ~[spring-ldap-core-2.3.3.RELEASE.jar:2.3.3.RELEASE]
支持docker部署么
我没有使用mvn clean package命令,而是在releases下载了对应的jar文件,修改了dockerfile文件,然后执行的sh脚本,请问是我下载的jar文件有问题吗
➜ Hello-Java-Sec git:(master) ✗ sh deploy.sh
Sending build context to Docker daemon 97.88MB
Step 1/6 : FROM java:8
manifest for java:8 not found: manifest unknown: manifest unknown
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.