diff --git a/generator/src/main/java/com/reajason/javaweb/probe/payload/FilterProbeFactory.java b/generator/src/main/java/com/reajason/javaweb/probe/payload/FilterProbeFactory.java index 62999446..1dc00ef9 100644 --- a/generator/src/main/java/com/reajason/javaweb/probe/payload/FilterProbeFactory.java +++ b/generator/src/main/java/com/reajason/javaweb/probe/payload/FilterProbeFactory.java @@ -45,6 +45,8 @@ public class FilterProbeFactory { return WebLogicFilterProbe.class; case Server.Undertow: return UndertowFilterProbe.class; + case Server.Resin: + return ResinFilterProbe.class; default: throw new GenerationException("filterProbe not supported for server: " + server); } diff --git a/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/ApusicFilterProbe.java b/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/ApusicFilterProbe.java index 230b1b39..e0d306e8 100644 --- a/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/ApusicFilterProbe.java +++ b/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/ApusicFilterProbe.java @@ -13,73 +13,58 @@ public class ApusicFilterProbe { @Override public String toString() { - String msg = ""; + StringBuilder msg = new StringBuilder(); Map>> allFiltersData = new LinkedHashMap>>(); Set contexts = null; try { contexts = getContext(); } catch (Throwable throwable) { - msg += "context error: " + getErrorMessage(throwable); + msg.append("context error: ").append(getErrorMessage(throwable)); } if (contexts == null || contexts.isEmpty()) { - msg += "context not found\n"; + msg.append("context not found\n"); } else { for (Object context : contexts) { String contextRoot = getContextRoot(context); - List> filters = collectFiltersData(context); - allFiltersData.put(contextRoot, filters); + try { + List> filters = collectFiltersData(context); + allFiltersData.put(contextRoot, filters); + } catch (Throwable e) { + msg.append(contextRoot).append(" failed ").append(getErrorMessage(e)).append("\n"); + } } - msg += formatFiltersData(allFiltersData); + msg.append(formatFiltersData(allFiltersData)); } - return msg; + return msg.toString(); } @SuppressWarnings("all") - private List> collectFiltersData(Object context) { + private List> collectFiltersData(Object context) throws Exception { Map> aggregatedData = new LinkedHashMap<>(); + Object webModule = getFieldValue(context, "webapp"); + Object[] filterMappings = (Object[]) invokeMethod(webModule, "getAllFilterMappings"); + Map filterClassMap = new HashMap<>(); - try { - Object webModule = getFieldValue(context, "webapp"); - if (webModule == null) { - return Collections.emptyList(); + for (Object fm : filterMappings) { + String name = (String) invokeMethod(fm, "getFilterName"); + if (!aggregatedData.containsKey(name)) { + Map info = new HashMap<>(); + Object filterModel = invokeMethod(webModule, "getFilter", new Class[]{String.class}, new Object[]{name}); + info.put("filterName", name); + info.put("filterClass", invokeMethod(filterModel, "getFilterClass")); + info.put("urlPatterns", new LinkedHashSet()); + info.put("servletNames", new LinkedHashSet()); + aggregatedData.put(name, info); } - - Object[] filterMappings = (Object[]) invokeMethod(webModule, "getAllFilterMappings"); - if (filterMappings == null || filterMappings.length == 0) { - return Collections.emptyList(); + Map info = aggregatedData.get(name); + String urlPattern = (String) invokeMethod(fm, "getUrlPattern"); + if (urlPattern != null) { + ((Set) info.get("urlPatterns")).add(urlPattern); } - - Object[] filters = (Object[]) invokeMethod(webModule, "getFilterList"); - Map filterClassMap = new HashMap<>(); - if (filters != null) { - for (Object filter : filters) { - String name = (String) invokeMethod(filter, "getName"); - String className = (String) invokeMethod(filter, "getFilterClass"); - if (name != null && className != null) { - filterClassMap.put(name, className); - } - } + String servletName = (String) invokeMethod(fm, "getServletName"); + if (servletName != null) { + ((Set) info.get("servletNames")).add(servletName); } - - for (Object fm : filterMappings) { - String name = (String) invokeMethod(fm, "getFilterName"); - if (name == null) { - continue; - } - if (!aggregatedData.containsKey(name)) { - Map info = new HashMap<>(); - info.put("filterName", name); - info.put("filterClass", filterClassMap.getOrDefault(name, "N/A")); - info.put("urlPatterns", new LinkedHashSet()); - aggregatedData.put(name, info); - } - Map info = aggregatedData.get(name); - String urlPattern = (String) invokeMethod(fm, "getUrlPattern"); - if (urlPattern != null) { - ((Set) info.get("urlPatterns")).add(urlPattern); - } - } - } catch (Exception ignored) { } List> result = new ArrayList<>(); @@ -89,6 +74,8 @@ public class ApusicFilterProbe { finalInfo.put("filterClass", (String) entry.get("filterClass")); Set urls = (Set) entry.get("urlPatterns"); finalInfo.put("urlPatterns", urls.isEmpty() ? "" : urls.toString()); + Set servletNames = (Set) entry.get("servletNames"); + finalInfo.put("servletNames", servletNames.isEmpty() ? "" : servletNames.toString()); result.add(finalInfo); } return result; @@ -108,6 +95,7 @@ public class ApusicFilterProbe { appendIfPresent(output, "", info.get("filterName"), ""); appendIfPresent(output, " -> ", info.get("filterClass"), ""); appendIfPresent(output, " -> URL:", info.get("urlPatterns"), ""); + appendIfPresent(output, " -> Servlet:", info.get("servletNames"), ""); output.append("\n"); } } @@ -176,27 +164,30 @@ public class ApusicFilterProbe { throw new NoSuchFieldException(fieldName + " for " + obj.getClass().getName()); } - @SuppressWarnings("all") - public static Object invokeMethod(Object obj, String methodName) { - try { - Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass(); - Method method = null; - while (clazz != null && method == null) { - try { - method = clazz.getDeclaredMethod(methodName); - } catch (NoSuchMethodException e) { - clazz = clazz.getSuperclass(); - } - } - if (method == null) { - throw new NoSuchMethodException("Method not found: " + methodName); - } + public static Object invokeMethod(Object obj, String methodName) throws Exception { + return invokeMethod(obj, methodName, null, null); + } - method.setAccessible(true); - return method.invoke(obj instanceof Class ? null : obj); - } catch (Exception e) { - throw new RuntimeException("Error invoking method: " + methodName, e); + @SuppressWarnings("all") + public static Object invokeMethod(Object obj, String methodName, Class[] paramClazz, Object[] param) throws Exception { + Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass(); + Method method = null; + while (clazz != null && method == null) { + try { + if (paramClazz == null) { + method = clazz.getDeclaredMethod(methodName); + } else { + method = clazz.getDeclaredMethod(methodName, paramClazz); + } + } catch (NoSuchMethodException e) { + clazz = clazz.getSuperclass(); + } } + if (method == null) { + throw new NoSuchMethodException("Method not found: " + methodName); + } + method.setAccessible(true); + return method.invoke(obj instanceof Class ? null : obj, param); } @SuppressWarnings("all") diff --git a/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/ResinFilterProbe.java b/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/ResinFilterProbe.java index 1e6e7e0f..07cb545a 100644 --- a/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/ResinFilterProbe.java +++ b/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/ResinFilterProbe.java @@ -13,73 +13,93 @@ public class ResinFilterProbe { @Override public String toString() { - String msg = ""; + StringBuilder msg = new StringBuilder(); Map>> allFiltersData = new LinkedHashMap>>(); Set contexts = null; try { contexts = getContext(); } catch (Throwable throwable) { - msg += "context error: " + getErrorMessage(throwable); + msg.append("context error: ").append(getErrorMessage(throwable)); } if (contexts == null || contexts.isEmpty()) { - msg += "context not found\n"; + msg.append("context not found\n"); } else { for (Object context : contexts) { String contextRoot = getContextRoot(context); - List> filters = collectFiltersData(context); - allFiltersData.put(contextRoot, filters); + try { + List> filters = collectFiltersData(context); + allFiltersData.put(contextRoot, filters); + } catch (Throwable e) { + msg.append(contextRoot).append(" failed ").append(getErrorMessage(e)).append("\n"); + } } - msg += formatFiltersData(allFiltersData); + msg.append(formatFiltersData(allFiltersData)); } - return msg; + return msg.toString(); } - private List> collectFiltersData(Object context) { - List> result = new ArrayList<>(); - try { - Object filterMapper = getFieldValue(context, "_filterMapper"); - Object filterManager = getFieldValue(context, "_filterManager"); - if (filterMapper == null) return Collections.emptyList(); - ArrayList filterMappings = (ArrayList) getFieldValue(filterMapper, "_filterMap"); - for (Object filterMapping : filterMappings) { - Map info = new HashMap<>(); - String filterName = (String) invokeMethod(filterMapping, "getFilterName", null, null); + @SuppressWarnings("unchecked") + private List> collectFiltersData(Object context) throws Exception { + Map> aggregatedData = new LinkedHashMap<>(); + Object filterMapper = getFieldValue(context, "_filterMapper"); + Object filterManager = getFieldValue(context, "_filterManager"); + if (filterMapper == null) return Collections.emptyList(); + ArrayList filterMappings = (ArrayList) getFieldValue(filterMapper, "_filterMap"); + for (Object filterMapping : filterMappings) { + String filterName = (String) invokeMethod(filterMapping, "getFilterName", null, null); + if (aggregatedData.get(filterName) == null) { + Map info = new HashMap<>(); info.put("filterName", filterName); String filterClassName = (String) invokeMethod(filterMapping, "getFilterClassName", null, null); - try { - if (filterClassName == null) { - Class filterClass = (Class) invokeMethod(filterMapping, "getFilterClass", null, null); - if (filterClass != null) { - filterClassName = filterClass.getName(); - } else { - Object filter = ((Map) getFieldValue(filterManager, "_instances")).get(filterName); - if (filter != null) { - filterClassName = filter.getClass().getName(); - } + if (filterClassName == null) { + Class filterClass = (Class) invokeMethod(filterMapping, "getFilterClass", null, null); + if (filterClass != null) { + filterClassName = filterClass.getName(); + } else { + Object filter = ((Map) getFieldValue(filterManager, "_instances")).get(filterName); + if (filter != null) { + filterClassName = filter.getClass().getName(); } } - } catch (Exception ignored) { } info.put("filterClass", filterClassName != null ? filterClassName : "N/A"); - - List urlPatterns = new ArrayList<>(); - String urlPattern = invokeMethod(filterMapping, "getURLPattern", null, null).toString(); - if (urlPattern == null || urlPattern.isEmpty()) { - List matchList = (List) getFieldValue(filterMapping, "_matchList"); - if (matchList != null && !matchList.isEmpty()) { - for (Object match : matchList) { - if (((Integer) getFieldValue(match, "_value")) == 1) { - urlPatterns.add(getFieldValue(match, "_regex").toString()); - } + info.put("urlPatterns", new LinkedHashSet()); + info.put("servletNames", new LinkedHashSet()); + aggregatedData.put(filterName, info); + } + Map info = aggregatedData.get(filterName); + List urlPatterns = new ArrayList<>(); + String urlPattern = (String) invokeMethod(filterMapping, "getURLPattern", null, null); + if (urlPattern == null || urlPattern.isEmpty()) { + List matchList = (List) getFieldValue(filterMapping, "_matchList"); + if (matchList != null && !matchList.isEmpty()) { + for (Object match : matchList) { + if (((Integer) getFieldValue(match, "_value")) == 1) { + urlPatterns.add(getFieldValue(match, "_regex").toString()); } } - } else { - urlPatterns.add(urlPattern); } - info.put("urlPatterns", Arrays.toString(urlPatterns.toArray())); - result.add(info); + } else { + urlPatterns.add(urlPattern); } - } catch (Exception ignored) { + if (!urlPatterns.isEmpty()) { + ((Set) info.get("urlPatterns")).addAll(urlPatterns); + } + List servletNames = (List) getFieldValue(filterMapping, "_servletNames"); + if (servletNames != null && !servletNames.isEmpty()) { + ((Set) info.get("servletNames")).addAll(servletNames); + } + } + List> result = new ArrayList<>(); + for (Map entry : aggregatedData.values()) { + Map finalInfo = new HashMap<>(); + finalInfo.put("filterName", (String) entry.get("filterName")); + finalInfo.put("filterClass", (String) entry.get("filterClass")); + Set urls = (Set) entry.get("urlPatterns"); + finalInfo.put("urlPatterns", urls.isEmpty() ? "" : urls.toString()); + Set servletNames = (Set) entry.get("servletNames"); + finalInfo.put("servletNames", servletNames.isEmpty() ? "" : servletNames.toString()); + result.add(finalInfo); } return result; } @@ -100,6 +120,7 @@ public class ResinFilterProbe { appendIfPresent(output, "", info.get("filterName"), ""); appendIfPresent(output, " -> ", info.get("filterClass"), ""); appendIfPresent(output, " -> URL:", info.get("urlPatterns"), ""); + appendIfPresent(output, " -> Servlet:", info.get("servletNames"), ""); output.append("\n"); } } diff --git a/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/WebSphereFilterProbe.java b/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/WebSphereFilterProbe.java index 7e5d81d1..bd461a01 100644 --- a/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/WebSphereFilterProbe.java +++ b/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/WebSphereFilterProbe.java @@ -13,89 +13,114 @@ public class WebSphereFilterProbe { @Override public String toString() { - String msg = ""; + StringBuilder msg = new StringBuilder(); Map>> allFiltersData = new LinkedHashMap>>(); Set contexts = null; try { contexts = getContext(); } catch (Throwable throwable) { - msg += "context error: " + getErrorMessage(throwable); + msg.append("context error: ").append(getErrorMessage(throwable)); } if (contexts == null || contexts.isEmpty()) { - msg += "context not found\n"; + msg.append("context not found\n"); } else { for (Object context : contexts) { String contextRoot = getContextRoot(context); - List> filters = collectFiltersData(context); - allFiltersData.put(contextRoot, filters); + try { + List> filters = collectFiltersData(context); + allFiltersData.put(contextRoot, filters); + } catch (Throwable e) { + msg.append(contextRoot).append(" failed ").append(getErrorMessage(e)).append("\n"); + } } - msg += formatFiltersData(allFiltersData); + msg.append(formatFiltersData(allFiltersData)); } - return msg; + return msg.toString(); } - private List> collectFiltersData(Object context) { + private List> collectFiltersData(Object context) throws Exception { Map> aggregatedData = new LinkedHashMap<>(); try { Object filterManager = getFieldValue(context, "filterManager"); Object webAppConfig = getFieldValue(context, "config"); try { List uriFilterMappingInfos = (List) getFieldValue(webAppConfig, "uriFilterMappingInfos"); - if (uriFilterMappingInfos == null || uriFilterMappingInfos.isEmpty()) { - return Collections.emptyList(); - } for (Object uriFilterMappingInfo : uriFilterMappingInfos) { Object filterConfig = getFieldValue(uriFilterMappingInfo, "filterConfig"); String filterName = (String) invokeMethod(filterConfig, "getFilterName", null, null); - Collection urlPatternMappings = (Collection) invokeMethod(filterConfig, "getUrlPatternMappings", null, null); - String urlPattern = (String) invokeMethod(uriFilterMappingInfo, "getUrlPattern", null, null); if (!aggregatedData.containsKey(filterName)) { String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null); Map info = new HashMap<>(); info.put("filterName", filterName); info.put("filterClass", filterClassName); - LinkedHashSet urlPatterns = new LinkedHashSet<>(); - if (urlPattern != null && !urlPattern.isEmpty()) { - urlPatterns.add(urlPattern); - } - if (urlPatternMappings != null) { - urlPatterns.addAll(urlPatternMappings); - } - info.put("urlPatterns", urlPatterns); + info.put("urlPatterns", new LinkedHashSet<>()); + info.put("servletNames", new LinkedHashSet<>()); aggregatedData.put(filterName, info); - } else { - Set urlPatterns = (Set) aggregatedData.get(filterName).get("urlPatterns"); - if (urlPattern != null && !urlPattern.isEmpty()) { - urlPatterns.add(urlPattern); - } - if (urlPatternMappings != null) { - urlPatterns.addAll(urlPatternMappings); - } + } + Map info = aggregatedData.get(filterName); + String urlPattern = (String) invokeMethod(uriFilterMappingInfo, "getUrlPattern", null, null); + if (urlPattern != null && !urlPattern.isEmpty()) { + ((Set) info.get("urlPatterns")).add(urlPattern); + } + } + + List servletFilterMappingInfos = (List) getFieldValue(webAppConfig, "servletFilterMappingInfos"); + for (Object servletFilterMappingInfo : servletFilterMappingInfos) { + Object filterConfig = getFieldValue(servletFilterMappingInfo, "filterConfig"); + String filterName = (String) invokeMethod(filterConfig, "getFilterName", null, null); + if (!aggregatedData.containsKey(filterName)) { + String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null); + Map info = new HashMap<>(); + info.put("filterName", filterName); + info.put("filterClass", filterClassName); + info.put("urlPatterns", new LinkedHashSet<>()); + info.put("servletNames", new LinkedHashSet<>()); + aggregatedData.put(filterName, info); + } + Map info = aggregatedData.get(filterName); + String servletName = (String) invokeMethod(invokeMethod(servletFilterMappingInfo, "getServletConfig"), "getServletName"); + if (servletName != null && !servletName.isEmpty()) { + ((Set) info.get("servletNames")).add(servletName); } } } catch (Throwable throwable) { - throwable.printStackTrace(); // WebLogic 10.3.6 List uriFilterMappings = (List) getFieldValue(filterManager, "_uriFilterMappings"); for (Object uriFilterMapping : uriFilterMappings) { String filterName = (String) getFieldValue(uriFilterMapping, "_filterName"); - String urlPattern = (String) getFieldValue(uriFilterMapping, "_filterURI"); if (!aggregatedData.containsKey(filterName)) { Object filterConfig = invokeMethod(webAppConfig, "getFilterInfo", new Class[]{String.class}, new Object[]{filterName}); String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null); Map info = new HashMap<>(); info.put("filterName", filterName); info.put("filterClass", filterClassName); - LinkedHashSet urlPatterns = new LinkedHashSet<>(); - if (urlPattern != null && !urlPattern.isEmpty()) { - urlPatterns.add(urlPattern); - } - info.put("urlPatterns", urlPatterns); + info.put("urlPatterns", new LinkedHashSet<>()); + info.put("servletNames", new LinkedHashSet<>()); aggregatedData.put(filterName, info); - } else { - if (urlPattern != null && !urlPattern.isEmpty()) { - ((Set) aggregatedData.get(filterName).get("urlPatterns")).add(urlPattern); - } + } + Map info = aggregatedData.get(filterName); + String urlPattern = (String) getFieldValue(uriFilterMapping, "_filterURI"); + if (urlPattern != null && !urlPattern.isEmpty()) { + ((Set) info.get("urlPatterns")).add(urlPattern); + } + } + List servletFilterMappings = (List) getFieldValue(filterManager, "_servletFilterMappings"); + for (Object servletFilterMapping : servletFilterMappings) { + String filterName = (String) getFieldValue(servletFilterMapping, "_filterName"); + if (!aggregatedData.containsKey(filterName)) { + Object filterConfig = invokeMethod(webAppConfig, "getFilterInfo", new Class[]{String.class}, new Object[]{filterName}); + String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null); + Map info = new HashMap<>(); + info.put("filterName", filterName); + info.put("filterClass", filterClassName); + info.put("urlPatterns", new LinkedHashSet<>()); + info.put("servletNames", new LinkedHashSet<>()); + aggregatedData.put(filterName, info); + } + Map info = aggregatedData.get(filterName); + String servletName = (String) getFieldValue(servletFilterMapping, "_filterServlet"); + if (servletName != null && !servletName.isEmpty()) { + ((Set) info.get("servletNames")).add(servletName); } } } @@ -108,7 +133,9 @@ public class WebSphereFilterProbe { finalInfo.put("filterName", (String) entry.get("filterName")); finalInfo.put("filterClass", (String) entry.get("filterClass")); Set urls = (Set) entry.get("urlPatterns"); - finalInfo.put("urlPatterns", urls.isEmpty() ? "[/*]" : Arrays.toString(urls.toArray())); + finalInfo.put("urlPatterns", urls.isEmpty() ? "" : urls.toString()); + Set servletNames = (Set) entry.get("servletNames"); + finalInfo.put("servletNames", servletNames.isEmpty() ? "" : servletNames.toString()); result.add(finalInfo); } return result; @@ -130,6 +157,7 @@ public class WebSphereFilterProbe { appendIfPresent(output, "", info.get("filterName"), ""); appendIfPresent(output, " -> ", info.get("filterClass"), ""); appendIfPresent(output, " -> URL:", info.get("urlPatterns"), ""); + appendIfPresent(output, " -> Servlet:", info.get("servletNames"), ""); output.append("\n"); } } @@ -208,6 +236,10 @@ public class WebSphereFilterProbe { return contexts; } + public static Object invokeMethod(Object obj, String methodName) { + return invokeMethod(obj, methodName, null, null); + } + @SuppressWarnings("all") public static Object invokeMethod(Object obj, String methodName, Class[] paramClazz, Object[] param) { try { diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/DetectionTool.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/DetectionTool.java index 72cb11e7..c4816141 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/DetectionTool.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/DetectionTool.java @@ -34,24 +34,4 @@ public class DetectionTool { public static String getServerDetection() { return getBase64Class(ServerProbe.class); } - - public static String getResinFilterProbe() { - return getBase64Class(ResinFilterProbe.class); - } - - public static String getUndertowFilterProbe() { - return getBase64Class(UndertowFilterProbe.class); - } - - public static String getApusicFilterProbe() { - return getBase64Class(ApusicFilterProbe.class); - } - - public static String getWebLogicFilterProbe() { - return getBase64Class(WebLogicFilterProbe.class); - } - - public static String getWebSphereFilterProbe() { - return getBase64Class(WebSphereFilterProbe.class); - } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin3116ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin3116ContainerTest.java index b82bfc85..af8e7f52 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin3116ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin3116ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.resin; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; import net.bytebuddy.jar.asm.Opcodes; @@ -81,20 +84,17 @@ public class Resin3116ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); + MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith("com.caucho.server.dispatch.handlers"))); + assertEquals(filterName, memShellResult.getShellClassName()); } } \ No newline at end of file diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin318ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin318ContainerTest.java index 2789710e..a1f61332 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin318ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin318ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.resin; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; import net.bytebuddy.jar.asm.Opcodes; @@ -86,20 +89,17 @@ public class Resin318ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); + MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith("com.caucho.server.dispatch.handlers"))); + assertEquals(filterName, memShellResult.getShellClassName()); } } \ No newline at end of file diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin4058ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin4058ContainerTest.java index a904d0a5..fd6f0b10 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin4058ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin4058ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.resin; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; import net.bytebuddy.jar.asm.Opcodes; @@ -80,20 +83,17 @@ public class Resin4058ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); + MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith("com.caucho.server.dispatch.handlers"))); + assertEquals(filterName, memShellResult.getShellClassName()); } } \ No newline at end of file diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin4067ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin4067ContainerTest.java index ac795bb1..0a4cd020 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin4067ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/resin/Resin4067ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.resin; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; import net.bytebuddy.jar.asm.Opcodes; @@ -80,20 +83,17 @@ public class Resin4067ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); + MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith("com.caucho.server.dispatch.handlers"))); + assertEquals(filterName, memShellResult.getShellClassName()); } } \ No newline at end of file diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty18ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty18ContainerTest.java index 63ababf8..3181b87c 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty18ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty18ContainerTest.java @@ -2,18 +2,19 @@ package com.reajason.javaweb.integration.probe.websphere; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; -import com.reajason.javaweb.utils.CommonUtil; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; import net.bytebuddy.jar.asm.Opcodes; import org.junit.jupiter.api.AfterAll; import org.junit.jupiter.api.Test; -import org.testcontainers.containers.BindMode; import org.testcontainers.containers.GenericContainer; import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.junit.jupiter.Container; @@ -27,8 +28,6 @@ import java.util.List; import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS; import static com.reajason.javaweb.integration.ContainerTool.warFile; import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk; -import static org.hamcrest.CoreMatchers.*; -import static org.hamcrest.MatcherAssert.assertThat; import static org.junit.jupiter.api.Assertions.assertEquals; /** @@ -91,21 +90,17 @@ public class OpenLiberty18ContainerTest { @Test void testFilterProbe() { String url = getUrlFromWAS(container); - String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrlFromWAS(container); - shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); - log.info(data); + MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty20ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty20ContainerTest.java index efbba576..05989000 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty20ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty20ContainerTest.java @@ -2,18 +2,19 @@ package com.reajason.javaweb.integration.probe.websphere; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; -import com.reajason.javaweb.utils.CommonUtil; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; import net.bytebuddy.jar.asm.Opcodes; import org.junit.jupiter.api.AfterAll; import org.junit.jupiter.api.Test; -import org.testcontainers.containers.BindMode; import org.testcontainers.containers.GenericContainer; import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.junit.jupiter.Container; @@ -27,8 +28,6 @@ import java.util.List; import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS; import static com.reajason.javaweb.integration.ContainerTool.warFile; import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk; -import static org.hamcrest.CoreMatchers.*; -import static org.hamcrest.MatcherAssert.assertThat; import static org.junit.jupiter.api.Assertions.assertEquals; /** @@ -91,21 +90,18 @@ public class OpenLiberty20ContainerTest { @Test void testFilterProbe() { String url = getUrlFromWAS(container); - String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrlFromWAS(container); - shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); + MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere)); log.info(data); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty22ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty22ContainerTest.java index 9e666efc..5d7ea706 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty22ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty22ContainerTest.java @@ -2,18 +2,19 @@ package com.reajason.javaweb.integration.probe.websphere; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; -import com.reajason.javaweb.utils.CommonUtil; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; import net.bytebuddy.jar.asm.Opcodes; import org.junit.jupiter.api.AfterAll; import org.junit.jupiter.api.Test; -import org.testcontainers.containers.BindMode; import org.testcontainers.containers.GenericContainer; import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.junit.jupiter.Container; @@ -27,8 +28,6 @@ import java.util.List; import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS; import static com.reajason.javaweb.integration.ContainerTool.warFile; import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk; -import static org.hamcrest.CoreMatchers.*; -import static org.hamcrest.MatcherAssert.assertThat; import static org.junit.jupiter.api.Assertions.assertEquals; /** @@ -91,21 +90,17 @@ public class OpenLiberty22ContainerTest { @Test void testFilterProbe() { String url = getUrlFromWAS(container); - String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrlFromWAS(container); - shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); - log.info(data); + MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty25ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty25ContainerTest.java index 094b8bfc..6221402a 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty25ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/OpenLiberty25ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.websphere; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -91,21 +94,17 @@ public class OpenLiberty25ContainerTest { @Test void testFilterProbe() { String url = getUrlFromWAS(container); - String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrlFromWAS(container); - shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); - log.info(data); + MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/WebSphere855ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/WebSphere855ContainerTest.java index 99b72250..87bc115d 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/WebSphere855ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/WebSphere855ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.websphere; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -26,7 +29,8 @@ import java.util.List; import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS; import static com.reajason.javaweb.integration.ContainerTool.warFile; import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk; -import static org.hamcrest.CoreMatchers.*; +import static org.hamcrest.CoreMatchers.anyOf; +import static org.hamcrest.CoreMatchers.startsWith; import static org.hamcrest.MatcherAssert.assertThat; import static org.junit.jupiter.api.Assertions.assertEquals; @@ -89,21 +93,17 @@ public class WebSphere855ContainerTest { @Test void testFilterProbe() { String url = getUrlFromWAS(container); - String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrlFromWAS(container); - shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); - log.info(data); + MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/WebSphere905ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/WebSphere905ContainerTest.java index ae64ef84..ccfc8c4a 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/WebSphere905ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere/WebSphere905ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.websphere; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -85,21 +88,17 @@ public class WebSphere905ContainerTest { @Test void testFilterProbe() { String url = getUrlFromWAS(container); - String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrlFromWAS(container); - shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); - log.info(data); + MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere7/WebSphere700ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere7/WebSphere700ContainerTest.java index 4094b3f3..937fa1bb 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere7/WebSphere700ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/websphere7/WebSphere700ContainerTest.java @@ -2,15 +2,19 @@ package com.reajason.javaweb.integration.probe.websphere7; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; import org.junit.jupiter.api.Test; +import org.objectweb.asm.Opcodes; import org.testcontainers.containers.BindMode; import org.testcontainers.containers.GenericContainer; import org.testcontainers.containers.wait.strategy.Wait; @@ -70,21 +74,17 @@ public class WebSphere700ContainerTest { @Test void testFilterProbe() { String url = getUrlFromWAS(container); - String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrlFromWAS(container); - shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); - log.info(data); + MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere)))); + assertEquals(filterName, memShellResult.getShellClassName()); } }