refactor: probe integration-test

This commit is contained in:
ReaJason
2026-01-18 23:49:41 +08:00
parent c5bfd3d92e
commit 60edda0cec
70 changed files with 1798 additions and 5116 deletions
-2
View File
@@ -1,2 +0,0 @@
#!/bin/bash
pgrep -f 'ASMain|GlassFishMain' | tr -d '\n'
@@ -28,13 +28,6 @@ public class ContainerTool {
public static final MountableFile springBoot3WebfluxJarFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-springboot3-webflux", "build", "libs", "vul-springboot3-webflux.jar").toAbsolutePath());
public static final Path neoGeorgDockerfile = Path.of("..", "assets", "neoreg", "Dockerfile").toAbsolutePath();
public static final Path springBoot1Dockerfile = Path.of("..", "vul", "vul-springboot1", "Dockerfile").toAbsolutePath();
public static final Path springBoot2Dockerfile = Path.of("..", "vul", "vul-springboot2", "Dockerfile").toAbsolutePath();
public static final Path springBoot2JettyDockerfile = Path.of("..", "vul", "vul-springboot2-jetty", "Dockerfile").toAbsolutePath();
public static final Path springBoot2UndertowDockerfile = Path.of("..", "vul", "vul-springboot2-undertow", "Dockerfile").toAbsolutePath();
public static final Path springBoot2WebfluxDockerfile = Path.of("..", "vul", "vul-springboot2-webflux", "Dockerfile").toAbsolutePath();
public static final Path springBoot3Dockerfile = Path.of("..", "vul", "vul-springboot3", "Dockerfile").toAbsolutePath();
public static final Path springBoot3WebfluxDockerfile = Path.of("..", "vul", "vul-springboot3-webflux", "Dockerfile").toAbsolutePath();
public static final MountableFile jattachFile = MountableFile.forHostPath(Path.of("..", "assets", "agent", "jattach-linux"));
public static final MountableFile tomcatPid = MountableFile.forHostPath(Path.of("script", "tomcat_pid.sh"));
@@ -42,7 +35,6 @@ public class ContainerTool {
public static final MountableFile resinPid = MountableFile.forHostPath(Path.of("script", "resin_pid.sh"));
public static final MountableFile jbossPid = MountableFile.forHostPath(Path.of("script", "jboss_pid.sh"));
public static final MountableFile glassfishPid = MountableFile.forHostPath(Path.of("script", "glassfish_pid.sh"));
public static final MountableFile besPid = MountableFile.forHostPath(Path.of("script", "bes_pid.sh"));
public static final MountableFile apusicPid = MountableFile.forHostPath(Path.of("script", "apusic_pid.sh"));
public static final MountableFile jettyPid = MountableFile.forHostPath(Path.of("script", "jetty_pid.sh"));
public static final MountableFile webspherePid = MountableFile.forHostPath(Path.of("script", "websphere_pid.sh"));
@@ -57,28 +49,4 @@ public class ContainerTool {
log.info("container started, app url is : {}", url);
return url;
}
public static String getUrlFromSpringBoot(GenericContainer<?> container) {
int port = container.getMappedPort(8080);
String host = container.getHost();
String url = "http://" + host + ":" + port;
log.info("container started, app url is : {}", url);
return url;
}
public static String getUrlFromWebLogic(GenericContainer<?> container) {
int port = container.getMappedPort(7001);
String host = container.getHost();
String url = "http://" + host + ":" + port + "/app";
log.info("container started, app url is : {}", url);
return url;
}
public static String getUrlFromWAS(GenericContainer<?> container) {
int port = container.getMappedPort(9080);
String host = container.getHost();
String url = "http://" + host + ":" + port + "/app";
log.info("container started, app url is : {}", url);
return url;
}
}
@@ -0,0 +1,217 @@
package com.reajason.javaweb.integration.probe;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
import org.apache.commons.lang3.StringUtils;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Assumptions;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.TestInstance;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.images.builder.ImageFromDockerfile;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* Abstract base class for probe container tests.
* Provides common test methods that are shared across all probe tests.
*
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@TestInstance(TestInstance.Lifecycle.PER_CLASS)
public abstract class AbstractProbeContainerTest {
/**
* Subclasses must provide their configuration.
*/
protected abstract ProbeTestConfig getConfig();
/**
* Subclasses must provide their container instance.
*/
protected abstract GenericContainer<?> getContainer();
/**
* Helper to build a container from config.
*/
protected static GenericContainer<?> buildContainer(ProbeTestConfig config) {
GenericContainer<?> container = new GenericContainer<>(config.getImageName());
if (config.getWarFile() != null && StringUtils.isNotBlank(config.getWarDeployPath())) {
container.withCopyToContainer(config.getWarFile(), config.getWarDeployPath());
}
if(config.getJarFile() != null && StringUtils.isNotBlank(config.getJarDeployPath())){
container.withCopyFileToContainer(config.getJarFile(), config.getJarDeployPath());
}
if (config.getWaitStrategy() != null) {
container.waitingFor(config.getWaitStrategy());
} else if (StringUtils.isNotBlank(config.getHealthCheckPath())) {
container.waitingFor(Wait.forHttp(config.getHealthCheckPath()));
}
container.withExposedPorts(config.getExposedPort());
if (config.isPrivilegedMode()) {
container.withPrivilegedMode(true);
}
if(config.getCommand() != null){
container.withCommand(config.getCommand());
}
return container;
}
/**
* Get the URL based on the configured strategy.
*/
protected String getUrl() {
GenericContainer<?> container = getContainer();
ProbeTestConfig config = getConfig();
int port = container.getMappedPort(config.getExposedPort());
String host = container.getHost();
String url = "http://" + host + ":" + port;
String contextPath = config.getContextPath();
if (StringUtils.isNotBlank(contextPath)) {
if (!contextPath.startsWith("/")) {
contextPath = "/" + contextPath;
}
url += contextPath;
}
log.info("container started, app url is: {}", url);
return url;
}
@AfterAll
void tearDown() {
GenericContainer<?> container = getContainer();
if (container != null) {
log.info(container.getLogs());
}
}
// ==================== Test Methods ====================
@Test
protected void testJDK() {
doTestJDK();
}
/**
* Subclasses can override testJDK() with @RetryingTest(3) and call this method.
*/
protected void doTestJDK() {
String url = getUrl();
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals(getConfig().getExpectedJdkVersion(), data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl();
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(
Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"),
data);
}
@Test
void testServerDetection() {
String url = getUrl();
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(getConfig().getServer(), data);
}
@Test
@SneakyThrows
protected void testCommandReqHeaderResponseBody() {
Assumptions.assumeTrue(getConfig().isSupportsCommand(),
"Command test not supported for this server");
String url = getUrl();
ProbeAssertion.responseCommandIsOk(url, getConfig().getServer(), getConfig().getTargetJdkVersion());
}
@Test
@SneakyThrows
protected void testScriptEngineReqHeaderResponseBody() {
Assumptions.assumeTrue(getConfig().isSupportsScriptEngine(),
"ScriptEngine test not supported for this server");
String url = getUrl();
ProbeAssertion.responseScriptEngineIsOk(url, getConfig().getServer(), getConfig().getTargetJdkVersion());
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
Assumptions.assumeTrue(getConfig().isSupportsBytecode(),
"Bytecode test not supported for this server");
String url = getUrl();
ProbeAssertion.responseBytecodeIsOk(url, getConfig().getServer(), getConfig().getTargetJdkVersion());
if (getConfig().isSupportsBytecodeWithoutPrefix()) {
ProbeAssertion.responseBytecodeWithoutPrefixIsOk(url, getConfig().getServer(), getConfig().getTargetJdkVersion());
}
}
@Test
void testFilterProbe() {
Assumptions.assumeTrue(getConfig().isSupportsFilterProbe(),
"Filter probe test not supported for this server");
String url = getUrl();
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(getConfig().getServer()));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
protected void testFilterFirstInject() {
Assumptions.assumeTrue(getConfig().isSupportsFilterProbe(),
"Filter first inject test not supported for this server");
String url = getUrl();
ProbeTestConfig config = getConfig();
String shellType = config.isJakarta() ? ShellType.JAKARTA_FILTER : ShellType.FILTER;
MemShellResult memShellResult = shellInjectIsOk(
url,
config.getServer(),
shellType,
ShellTool.Command,
getConfig().getTargetJdkVersion(),
Packers.BigInteger,
getContainer());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(config.getServer()));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
}
@Test
@SneakyThrows
protected void testCommandReqHeaderResponseBodySpring() {
Assumptions.assumeTrue(getConfig().isSupportsSpringWebMvc(),
"Spring WebMVC test not supported for this server");
String url = getUrl();
ProbeAssertion.responseCommandIsOk(url, Server.SpringWebMvc, getConfig().getTargetJdkVersion());
}
}
@@ -0,0 +1,325 @@
package com.reajason.javaweb.integration.probe;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ContainerTool;
import lombok.Builder;
import lombok.Getter;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.wait.strategy.WaitStrategy;
import org.testcontainers.utility.MountableFile;
import java.nio.file.Path;
/**
* Configuration class for probe container tests.
* Uses builder pattern similar to ContainerTestConfig.
*
* @author ReaJason
* @since 2024/12/4
*/
@Getter
@Builder
public class ProbeTestConfig {
private final String imageName;
private final String server;
private final String expectedJdkVersion;
@Builder.Default
private final int targetJdkVersion = Opcodes.V1_8;
@Builder.Default
private final int exposedPort = 8080;
@Builder.Default
private final String contextPath = "/app";
@Builder.Default
private final String healthCheckPath = "/app";
private final WaitStrategy waitStrategy;
private final MountableFile warFile;
private final String warDeployPath;
private final MountableFile jarFile;
private final String jarDeployPath;
private final String command;
@Builder.Default
private final boolean privilegedMode = false;
@Builder.Default
private final boolean supportsScriptEngine = false;
@Builder.Default
private final boolean supportsFilterProbe = true;
@Builder.Default
private final boolean supportsCommand = true;
@Builder.Default
private final boolean supportsBytecode = true;
@Builder.Default
private final boolean supportsSpringWebMvc = false;
@Builder.Default
private final boolean supportsBytecodeWithoutPrefix = false;
@Builder.Default
private final boolean jakarta = false;
// Factory methods for common server configurations
public static ProbeTestConfigBuilder tomcat(String imageName) {
return builder()
.imageName(imageName)
.server(Server.Tomcat)
.warFile(ContainerTool.warFile)
.warDeployPath("/usr/local/tomcat/webapps/app.war")
.supportsScriptEngine(true)
.supportsBytecodeWithoutPrefix(true);
}
public static ProbeTestConfigBuilder tomcatJakarta(String imageName) {
return builder()
.imageName(imageName)
.server(Server.Tomcat)
.warFile(ContainerTool.warJakartaFile)
.warDeployPath("/usr/local/tomcat/webapps/app.war")
.supportsBytecodeWithoutPrefix(true)
.jakarta(true);
}
public static ProbeTestConfigBuilder jetty(String imageName) {
return builder()
.imageName(imageName)
.server(Server.Jetty)
.warFile(ContainerTool.warFile)
.warDeployPath("/var/lib/jetty/webapps/app.war");
}
public static ProbeTestConfigBuilder jettyJakarta(String imageName) {
return builder()
.imageName(imageName)
.server(Server.Jetty)
.warFile(ContainerTool.warJakartaFile)
.warDeployPath("/var/lib/jetty/webapps/app.war")
.jakarta(true)
.supportsBytecode(false);
}
public static ProbeTestConfigBuilder jettyOld(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.Jetty)
.warFile(ContainerTool.warFile)
.warDeployPath(warDeployPath);
}
public static ProbeTestConfigBuilder glassfish(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.GlassFish)
.warFile(ContainerTool.warFile)
.warDeployPath(warDeployPath);
}
public static ProbeTestConfigBuilder glassfishJakarta(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.GlassFish)
.warFile(ContainerTool.warJakartaFile)
.warDeployPath(warDeployPath)
.jakarta(true);
}
public static ProbeTestConfigBuilder payara(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.GlassFish)
.warFile(ContainerTool.warFile)
.warDeployPath(warDeployPath);
}
public static ProbeTestConfigBuilder payaraJakarta(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.GlassFish)
.warFile(ContainerTool.warJakartaFile)
.warDeployPath(warDeployPath)
.jakarta(true);
}
public static ProbeTestConfigBuilder weblogic(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.WebLogic)
.warFile(ContainerTool.warFile)
.warDeployPath(warDeployPath)
.exposedPort(7001);
}
public static ProbeTestConfigBuilder websphere(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.WebSphere)
.warFile(ContainerTool.warFile)
.warDeployPath(warDeployPath)
.exposedPort(9080)
.privilegedMode(true);
}
public static ProbeTestConfigBuilder openLiberty(String imageName) {
return builder()
.imageName(imageName)
.server(Server.WebSphere)
.warFile(ContainerTool.warFile)
.warDeployPath("/config/dropins/app.war")
.exposedPort(9080);
}
public static ProbeTestConfigBuilder wildfly(String imageName) {
return builder()
.imageName(imageName)
.server(Server.Undertow)
.warFile(ContainerTool.warFile)
.warDeployPath("/opt/jboss/wildfly/standalone/deployments/app.war");
}
public static ProbeTestConfigBuilder wildflyJakarta(String imageName) {
return builder()
.imageName(imageName)
.server(Server.Undertow)
.warFile(ContainerTool.warJakartaFile)
.warDeployPath("/opt/jboss/wildfly/standalone/deployments/app.war")
.jakarta(true);
}
public static ProbeTestConfigBuilder jboss(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.JBoss)
.warFile(ContainerTool.warFile)
.warDeployPath(warDeployPath);
}
public static ProbeTestConfigBuilder jbossEap(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.Undertow)
.warFile(ContainerTool.warFile)
.warDeployPath(warDeployPath);
}
public static ProbeTestConfigBuilder jbossEapJakarta(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.Undertow)
.warFile(ContainerTool.warJakartaFile)
.warDeployPath(warDeployPath)
.jakarta(true);
}
public static ProbeTestConfigBuilder resin(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.Resin)
.warFile(ContainerTool.warFile)
.warDeployPath(warDeployPath);
}
public static ProbeTestConfigBuilder springboot(String imageName, MountableFile jarFile) {
return builder()
.imageName(imageName)
.jarFile(jarFile)
.jarDeployPath("/app/app.jar")
.command("java -jar /app/app.jar")
.server(Server.Tomcat)
.contextPath("")
.healthCheckPath("/test")
.supportsFilterProbe(false)
.supportsSpringWebMvc(true);
}
public static ProbeTestConfigBuilder springbootJetty(String imageName, MountableFile jarFile) {
return builder()
.imageName(imageName)
.jarFile(jarFile)
.jarDeployPath("/app/app.jar")
.command("java -jar /app/app.jar")
.server(Server.Jetty)
.contextPath("")
.healthCheckPath("/test")
.supportsFilterProbe(false)
.supportsSpringWebMvc(true);
}
public static ProbeTestConfigBuilder springbootUndertow(String imageName, MountableFile jarFile) {
return builder()
.imageName(imageName)
.jarFile(jarFile)
.jarDeployPath("/app/app.jar")
.command("java -jar /app/app.jar")
.server(Server.Undertow)
.contextPath("")
.healthCheckPath("/test")
.supportsFilterProbe(false)
.supportsSpringWebMvc(true);
}
public static ProbeTestConfigBuilder springwebflux(String imageName, MountableFile jarFile) {
return builder()
.imageName(imageName)
.jarFile(jarFile)
.jarDeployPath("/app/app.jar")
.command("java -jar /app/app.jar")
.server(Server.SpringWebFlux)
.contextPath("")
.healthCheckPath("/test")
.supportsFilterProbe(false)
.supportsCommand(false)
.supportsBytecode(false);
}
public static ProbeTestConfigBuilder tongweb(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.TongWeb)
.warFile(ContainerTool.warFile)
.warDeployPath(warDeployPath);
}
public static ProbeTestConfigBuilder bes(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.BES)
.warFile(ContainerTool.warFile)
.warDeployPath(warDeployPath);
}
public static ProbeTestConfigBuilder apusic(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.Apusic)
.warFile(ContainerTool.warFile)
.warDeployPath(warDeployPath);
}
public static ProbeTestConfigBuilder inforsuite(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.InforSuite)
.warFile(ContainerTool.warFile)
.warDeployPath(warDeployPath);
}
public static ProbeTestConfigBuilder primeton(String imageName, String warDeployPath) {
return builder()
.imageName(imageName)
.server(Server.GlassFish)
.warFile(ContainerTool.warFile)
.warDeployPath(warDeployPath);
}
}
@@ -1,110 +1,36 @@
package com.reajason.javaweb.integration.probe.glassfish;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/12
*/
@Slf4j
@Testcontainers
public class GlassFish3ContainerTest {
public static final String imageName = "reajason/glassfish:3.1.2.2-jdk6";
public class GlassFish3ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.glassfish(
"reajason/glassfish:3.1.2.2-jdk6",
"/usr/local/glassfish3/glassfish/domains/domain1/autodeploy/app.war")
.expectedJdkVersion("JDK|1.6.0_45|50")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/glassfish3/glassfish/domains/domain1/autodeploy/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@BeforeAll
static void setup() {
container.waitingFor(Wait.forLogMessage(".*(deployed|done).*", 1));
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@AfterAll
static void teardown() {
log.info(container.getLogs());
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.6.0_45|50", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.GlassFish, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.GlassFish, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.GlassFish, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,110 +1,36 @@
package com.reajason.javaweb.integration.probe.glassfish;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/12
*/
@Slf4j
@Testcontainers
public class GlassFish4ContainerTest {
public static final String imageName = "reajason/glassfish:4.1.2-quick";
public class GlassFish4ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.glassfish(
"reajason/glassfish:4.1.2-quick",
"/usr/local/glassfish4/glassfish/domains/domain1/autodeploy/app.war")
.expectedJdkVersion("JDK|1.8.0_271|52")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/glassfish4/glassfish/domains/domain1/autodeploy/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@BeforeAll
static void setup() {
container.waitingFor(Wait.forLogMessage(".*(deployed|done).*", 1));
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@AfterAll
static void tearDown() {
System.out.println(container.getLogs());
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_271|52", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.GlassFish, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.GlassFish, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.GlassFish, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,103 +1,36 @@
package com.reajason.javaweb.integration.probe.glassfish;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/12
*/
@Slf4j
@Testcontainers
public class GlassFish501ContainerTest {
public static final String imageName = "reajason/glassfish:5.0.1";
public class GlassFish501ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.glassfish(
"reajason/glassfish:5.0.1",
"/usr/local/glassfish5/glassfish/domains/domain1/autodeploy/app.war")
.expectedJdkVersion("JDK|1.8.0_411|52")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/glassfish5/glassfish/domains/domain1/autodeploy/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@BeforeAll
static void setup() {
container.waitingFor(Wait.forLogMessage(".*(deployed|done).*", 1));
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_411|52", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.GlassFish, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.GlassFish, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.GlassFish, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,104 +1,36 @@
package com.reajason.javaweb.integration.probe.glassfish;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/12
*/
@Slf4j
@Testcontainers
public class GlassFish510ContainerTest {
public static final String imageName = "reajason/glassfish:5.1.0";
public class GlassFish510ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.glassfish(
"reajason/glassfish:5.1.0",
"/usr/local/glassfish5/glassfish/domains/domain1/autodeploy/app.war")
.expectedJdkVersion("JDK|1.8.0_411|52")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/glassfish5/glassfish/domains/domain1/autodeploy/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@BeforeAll
static void setup() {
container.waitingFor(Wait.forLogMessage(".*(deployed|done).*", 1));
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_411|52", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.GlassFish, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.GlassFish, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.GlassFish, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,104 +1,36 @@
package com.reajason.javaweb.integration.probe.glassfish;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/12
*/
@Slf4j
@Testcontainers
public class GlassFish6ContainerTest {
public static final String imageName = "reajason/glassfish:6.2.6-jdk11";
public class GlassFish6ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.glassfishJakarta(
"reajason/glassfish:6.2.6-jdk11",
"/usr/local/glassfish6/glassfish/domains/domain1/autodeploy/app.war")
.expectedJdkVersion("JDK|11.0.16|55")
.targetJdkVersion(Opcodes.V11)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warJakartaFile, "/usr/local/glassfish6/glassfish/domains/domain1/autodeploy/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@BeforeAll
static void setup() {
container.waitingFor(Wait.forLogMessage(".*(deployed|done).*", 1));
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|11.0.16|55", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.GlassFish, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.GlassFish, Opcodes.V11);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.GlassFish, Opcodes.V11);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,110 +1,38 @@
package com.reajason.javaweb.integration.probe.glassfish;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/12
*/
@Slf4j
@Testcontainers
public class GlassFish7ContainerTest {
public static final String imageName = "reajason/glassfish:7.0.20-jdk17";
public class GlassFish7ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.glassfishJakarta(
"reajason/glassfish:7.0.20-jdk17",
"/usr/local/glassfish7/glassfish/domains/domain1/autodeploy/app.war")
.expectedJdkVersion("JDK|17.0.2|61")
.targetJdkVersion(Opcodes.V17)
.waitStrategy(Wait.forLogMessage(".*JMXService.*", 1))
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warJakartaFile, "/usr/local/glassfish7/glassfish/domains/domain1/autodeploy/app.war")
.waitingFor(Wait.forLogMessage(".*JMXService.*", 1))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@BeforeAll
static void setup() {
container.waitingFor(Wait.forHttp("/app/test"));
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@AfterAll
public static void tearDown() {
System.out.println(container.getLogs());
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|17.0.2|61", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.GlassFish, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.GlassFish, Opcodes.V17);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.GlassFish, Opcodes.V17);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,99 +1,37 @@
package com.reajason.javaweb.integration.probe.jbossas;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/10
*/
@Slf4j
@Testcontainers
public class Jboss423ContainerTest {
public static final String imageName = "reajason/jboss:4-jdk6";
public class Jboss423ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jboss(
"reajason/jboss:4-jdk6",
"/usr/local/jboss/server/default/deploy/app.war")
.expectedJdkVersion("JDK|1.6.0_45|50")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/jboss/server/default/deploy/app.war")
.withEnv("JAVA_OPTS", "-Xms128m -Xmx512m -XX:MaxPermSize=128M -Dsun.rmi.dgc.client.gcInterval=3600000 -Dsun.rmi.dgc.server.gcInterval=3600000")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG)
.withEnv("JAVA_OPTS", "-Xms128m -Xmx512m -XX:MaxPermSize=128M -Dsun.rmi.dgc.client.gcInterval=3600000 -Dsun.rmi.dgc.server.gcInterval=3600000");
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.6.0_45|50", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.JBoss, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.JBoss, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.JBoss, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.JBoss));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,97 +1,36 @@
package com.reajason.javaweb.integration.probe.jbossas;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/10
*/
@Slf4j
@Testcontainers
public class Jboss510ContainerTest {
public static final String imageName = "reajason/jboss:5-jdk6";
public class Jboss510ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jboss(
"reajason/jboss:5-jdk6",
"/usr/local/jboss/server/web/deploy/app.war")
.expectedJdkVersion("JDK|1.6.0_45|50")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/jboss/server/web/deploy/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.6.0_45|50", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.JBoss, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.JBoss, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.JBoss, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.JBoss));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,97 +1,36 @@
package com.reajason.javaweb.integration.probe.jbossas;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/10
*/
@Slf4j
@Testcontainers
public class Jboss610ContainerTest {
public static final String imageName = "reajason/jboss:6-jdk7";
public class Jboss610ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jboss(
"reajason/jboss:6-jdk7",
"/usr/local/jboss/server/jbossweb-standalone/deploy/app.war")
.expectedJdkVersion("JDK|1.7.0_17|51")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/jboss/server/jbossweb-standalone/deploy/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.7.0_17|51", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.JBoss, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.JBoss, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.JBoss, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.JBoss));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,97 +1,36 @@
package com.reajason.javaweb.integration.probe.jbossas;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/10
*/
@Slf4j
@Testcontainers
public class Jboss711ContainerTest {
public static final String imageName = "reajason/jboss:7-jdk7";
public class Jboss711ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jboss(
"reajason/jboss:7-jdk7",
"/usr/local/jboss/standalone/deployments/app.war")
.expectedJdkVersion("JDK|1.7.0_17|51")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/jboss/standalone/deployments/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.7.0_17|51", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.JBoss, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.JBoss, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.JBoss, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.JBoss));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -2,29 +2,22 @@ package com.reajason.javaweb.integration.probe.jbosseap;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -32,63 +25,41 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
* @author ReaJason
* @since 2024/12/10
*/
@Slf4j
@Testcontainers
public class JbossEap6ContainerTest {
public static final String imageName = "reajason/jboss:eap-6-jdk8";
public class JbossEap6ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jboss(
"reajason/jboss:eap-6-jdk8",
"/usr/local/jboss/standalone/deployments/app.war")
.expectedJdkVersion("JDK|1.8.0_342|52")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/jboss/standalone/deployments/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_342|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Override
protected GenericContainer<?> getContainer() {
return container;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
protected void testFilterFirstInject() {
String url = getUrl();
MemShellResult memShellResult = shellInjectIsOk(
url,
getConfig().getServer(),
ShellType.FILTER,
ShellTool.Command,
Opcodes.V1_6,
Packers.BigInteger,
getContainer());
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.JBoss, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.JBoss, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.JBoss, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.JBoss));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
@@ -1,104 +1,36 @@
package com.reajason.javaweb.integration.probe.jbosseap;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/10
*/
@Slf4j
@Testcontainers
public class JbossEap7ContainerTest {
public static final String imageName = "reajason/jboss:eap-7-jdk8";
public class JbossEap7ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jbossEap(
"reajason/jboss:eap-7-jdk8",
"/usr/local/jboss/standalone/deployments/app.war")
.expectedJdkVersion("JDK|1.8.0_342|52")
.targetJdkVersion(Opcodes.V1_8)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/jboss/standalone/deployments/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@AfterAll
public static void tearDown() {
log.info(container.getLogs());
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_342|52", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Undertow, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Undertow, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Undertow, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Undertow, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,98 +1,36 @@
package com.reajason.javaweb.integration.probe.jbosseap;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/10
*/
@Slf4j
@Testcontainers
public class JbossEap81ContainerTest {
public static final String imageName = "reajason/jboss:eap-8.1-jdk17";
public class JbossEap81ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jbossEapJakarta(
"reajason/jboss:eap-8.1-jdk17",
"/usr/local/jboss/standalone/deployments/app.war")
.expectedJdkVersion("JDK|17.0.15|61")
.targetJdkVersion(Opcodes.V17)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warJakartaFile, "/usr/local/jboss/standalone/deployments/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|17.0.15|61", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Undertow, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Undertow, Opcodes.V17);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Undertow, Opcodes.V17);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Undertow, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,103 +1,34 @@
package com.reajason.javaweb.integration.probe.jetty;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/7
*/
@Slf4j
@Testcontainers
public class Jetty10ContainerTest {
public static final String imageName = "jetty:10.0.25-jre11";
public class Jetty10ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jetty("jetty:10.0.25-jre11")
.expectedJdkVersion("JRE|11.0.28|55")
.targetJdkVersion(Opcodes.V11)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/var/lib/jetty/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@AfterAll
public static void tearDown() {
log.info(container.getLogs());
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|11.0.28|55", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Jetty, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Jetty, Opcodes.V11);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Jetty, Opcodes.V11);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V11, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,103 +1,35 @@
package com.reajason.javaweb.integration.probe.jetty;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/7
*/
@Slf4j
@Testcontainers
public class Jetty11ContainerTest {
public static final String imageName = "jetty:11.0.25-jre17";
public class Jetty11ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jettyJakarta("jetty:11.0.25-jre17")
.expectedJdkVersion("JRE|17.0.16|61")
.targetJdkVersion(Opcodes.V17)
.supportsBytecode(true)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warJakartaFile, "/var/lib/jetty/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@AfterAll
public static void tearDown() {
System.out.println(container.getLogs());
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|17.0.16|61", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Jetty, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Jetty, Opcodes.V17);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Jetty, Opcodes.V17);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,92 +1,34 @@
package com.reajason.javaweb.integration.probe.jetty;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.hamcrest.CoreMatchers.anyOf;
import static org.hamcrest.CoreMatchers.startsWith;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/7
*/
@Slf4j
@Testcontainers
public class Jetty12ee10ContainerTest {
public static final String imageName = "reajason/jetty:12.0-jre21-ee10";
public class Jetty12ee10ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jettyJakarta("reajason/jetty:12.0-jre21-ee10")
.expectedJdkVersion("JRE|21.0.9|65")
.targetJdkVersion(Opcodes.V21)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warJakartaFile, "/var/lib/jetty/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|21.0.9|65", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Jetty, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Jetty, Opcodes.V21);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.Jetty, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("org.eclipse.jetty.servlet.handlers")));
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,92 +1,34 @@
package com.reajason.javaweb.integration.probe.jetty;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.hamcrest.CoreMatchers.anyOf;
import static org.hamcrest.CoreMatchers.startsWith;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/7
*/
@Slf4j
@Testcontainers
public class Jetty12ee11ContainerTest {
public static final String imageName = "reajason/jetty:12.1-jre21-ee11";
public class Jetty12ee11ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jettyJakarta("reajason/jetty:12.1-jre21-ee11")
.expectedJdkVersion("JDK|21.0.9|65")
.targetJdkVersion(Opcodes.V21)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warJakartaFile, "/var/lib/jetty/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|21.0.9|65", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Jetty, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Jetty, Opcodes.V21);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.Jetty, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("org.eclipse.jetty.servlet.handlers")));
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,96 +1,36 @@
package com.reajason.javaweb.integration.probe.jetty;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/7
*/
@Slf4j
@Testcontainers
public class Jetty12ee8ContainerTest {
public static final String imageName = "reajason/jetty:12.0-jre21-ee8";
public class Jetty12ee8ContainerTest extends AbstractProbeContainerTest {
// Jetty 12 ee8 uses javax.servlet (not Jakarta), so we use jetty() factory
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jetty("reajason/jetty:12.0-jre21-ee8")
.expectedJdkVersion("JRE|21.0.9|65")
.targetJdkVersion(Opcodes.V21)
.supportsBytecode(false)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/var/lib/jetty/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@AfterAll
public static void tearDown() {
log.info(container.getLogs());
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|21.0.9|65", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Jetty, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Jetty, Opcodes.V21);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,92 +1,34 @@
package com.reajason.javaweb.integration.probe.jetty;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.hamcrest.CoreMatchers.anyOf;
import static org.hamcrest.CoreMatchers.startsWith;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/7
*/
@Slf4j
@Testcontainers
public class Jetty12ee9ContainerTest {
public static final String imageName = "reajason/jetty:12.0-jre21-ee9";
public class Jetty12ee9ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jettyJakarta("reajason/jetty:12.0-jre21-ee9")
.expectedJdkVersion("JRE|21.0.9|65")
.targetJdkVersion(Opcodes.V21)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warJakartaFile, "/var/lib/jetty/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|21.0.9|65", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Jetty, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Jetty, Opcodes.V21);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.Jetty, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("org.eclipse.jetty.servlet.handlers")));
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,103 +1,34 @@
package com.reajason.javaweb.integration.probe.jetty;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/7
*/
@Slf4j
@Testcontainers
public class Jetty61ContainerTest {
public static final String imageName = "reajason/jetty:6.1-jdk6";
public class Jetty61ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jettyOld("reajason/jetty:6.1-jdk6", "/usr/local/jetty/webapps/app.war")
.expectedJdkVersion("JDK|1.6.0_45|50")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/jetty/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@AfterAll
public static void tearDown() {
System.out.println(container.getLogs());
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.6.0_45|50", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Jetty, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Jetty, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Jetty, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,97 +1,34 @@
package com.reajason.javaweb.integration.probe.jetty;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/7
*/
@Slf4j
@Testcontainers
public class Jetty75ContainerTest {
public static final String imageName = "reajason/jetty:7.5.4-jdk6";
public class Jetty75ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jettyOld("reajason/jetty:7.5.4-jdk6", "/usr/local/jetty/webapps/app.war")
.expectedJdkVersion("JDK|1.6.0_45|50")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/jetty/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.6.0_45|50", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Jetty, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Jetty, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Jetty, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,97 +1,34 @@
package com.reajason.javaweb.integration.probe.jetty;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/7
*/
@Slf4j
@Testcontainers
public class Jetty76ContainerTest {
public static final String imageName = "reajason/jetty:7.6-jdk6";
public class Jetty76ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jettyOld("reajason/jetty:7.6-jdk6", "/usr/local/jetty/webapps/app.war")
.expectedJdkVersion("JDK|1.6.0_45|50")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/jetty/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.6.0_45|50", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Jetty, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Jetty, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Jetty, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,97 +1,36 @@
package com.reajason.javaweb.integration.probe.jetty;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/7
*/
@Slf4j
@Testcontainers
public class Jetty81ContainerTest {
public static final String imageName = "reajason/jetty:8.1-jdk7";
public class Jetty81ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig
.jettyOld("reajason/jetty:8.1-jdk7",
"/usr/local/jetty/webapps/app.war")
.expectedJdkVersion("JDK|1.7.0_17|51")
.targetJdkVersion(Opcodes.V1_7)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/jetty/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.7.0_17|51", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Jetty, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Jetty, Opcodes.V1_7);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Jetty, Opcodes.V1_7);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,98 +1,34 @@
package com.reajason.javaweb.integration.probe.jetty;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/7
*/
@Slf4j
@Testcontainers
public class Jetty92ContainerTest {
public class Jetty92ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jetty("jetty:9.2-jre7")
.expectedJdkVersion("JRE|1.7.0_221|51")
.targetJdkVersion(Opcodes.V1_7)
.build();
public static final String imageName = "jetty:9.2-jre7";
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/var/lib/jetty/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|1.7.0_221|51", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Jetty, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Jetty, Opcodes.V1_7);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Jetty, Opcodes.V1_7);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,97 +1,34 @@
package com.reajason.javaweb.integration.probe.jetty;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/7
*/
@Slf4j
@Testcontainers
public class Jetty93ContainerTest {
public static final String imageName = "reajason/jetty:9.3";
public class Jetty93ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jetty("reajason/jetty:9.3")
.expectedJdkVersion("JDK|1.8.0_342|52")
.targetJdkVersion(Opcodes.V1_8)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/var/lib/jetty/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_342|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Jetty, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Jetty, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Jetty, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,97 +1,34 @@
package com.reajason.javaweb.integration.probe.jetty;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/7
*/
@Slf4j
@Testcontainers
public class Jetty94ContainerTest {
public static final String imageName = "jetty:9.4.57-jre8";
public class Jetty94ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.jetty("jetty:9.4.57-jre8")
.expectedJdkVersion("JRE|1.8.0_462|52")
.targetJdkVersion(Opcodes.V1_8)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/var/lib/jetty/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|1.8.0_462|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Jetty, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Jetty, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Jetty, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,109 +1,36 @@
package com.reajason.javaweb.integration.probe.payara;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/12
*/
@Slf4j
@Testcontainers
public class Payara5201ContainerTest {
public static final String imageName = "reajason/payara:5.201";
public class Payara5201ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.payara(
"reajason/payara:5.201",
"/usr/local/payara5/glassfish/domains/domain1/autodeploy/app.war")
.expectedJdkVersion("JDK|1.8.0_151|52")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/payara5/glassfish/domains/domain1/autodeploy/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@BeforeAll
static void setup() {
container.waitingFor(Wait.forLogMessage(".*JMXService.*", 1));
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@AfterAll
public static void tearDown() {
System.out.println(container.getLogs());
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_151|52", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.GlassFish, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.GlassFish, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.GlassFish, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,103 +1,36 @@
package com.reajason.javaweb.integration.probe.payara;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/12
*/
@Slf4j
@Testcontainers
public class Payara520225ContainerTest {
public static final String imageName = "reajason/payara:5.2022.5";
public class Payara520225ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.payara(
"reajason/payara:5.2022.5",
"/usr/local/payara5/glassfish/domains/domain1/autodeploy/app.war")
.expectedJdkVersion("JDK|1.8.0_432|52")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/payara5/glassfish/domains/domain1/autodeploy/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@BeforeAll
static void setup() {
container.waitingFor(Wait.forLogMessage(".*JMXService.*", 1));
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_432|52", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.GlassFish, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.GlassFish, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.GlassFish, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,31 +1,23 @@
package com.reajason.javaweb.integration.probe.payara;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.BeforeAll;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -33,70 +25,44 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
* @author ReaJason
* @since 2024/12/12
*/
@Slf4j
@Testcontainers
public class Payara620222ContainerTest {
public static final String imageName = "reajason/payara:6.2022.2-jdk11";
public class Payara620222ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.payaraJakarta(
"reajason/payara:6.2022.2-jdk11",
"/usr/local/payara6/glassfish/domains/domain1/autodeploy/app.war")
.expectedJdkVersion("JDK|11.0.25|55")
.targetJdkVersion(Opcodes.V11)
.waitStrategy(Wait.forLogMessage(".*JMXService.*", 1))
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warJakartaFile, "/usr/local/payara6/glassfish/domains/domain1/autodeploy/app.war")
.waitingFor(Wait.forLogMessage(".*JMXService.*", 1))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@BeforeAll
static void setup() {
container.waitingFor(Wait.forHttp("/app/test"));
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Override
protected GenericContainer<?> getContainer() {
return container;
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|11.0.25|55", data);
}
protected void testFilterFirstInject() {
String url = getUrl();
String shellType = getConfig().isJakarta() ? ShellType.JAKARTA_FILTER : ShellType.FILTER;
MemShellResult memShellResult = shellInjectIsOk(
url,
getConfig().getServer(),
shellType,
ShellTool.Command,
Opcodes.V11,
Packers.BigInteger,
getContainer());
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.GlassFish, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.GlassFish, Opcodes.V11);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.GlassFish, Opcodes.V11);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(getConfig().getServer()));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@@ -1,97 +1,34 @@
package com.reajason.javaweb.integration.probe.resin;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Resin3116ContainerTest {
public static final String imageName = "reajason/resin:3.1.16";
public class Resin3116ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.resin("reajason/resin:3.1.16", "/usr/local/resin3/webapps/app.war")
.expectedJdkVersion("JDK|1.8.0_342|52")
.targetJdkVersion(Opcodes.V1_8)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/resin3/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_342|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
@Override
protected GenericContainer<?> getContainer() {
return container;
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Resin, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Resin, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Resin, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
}
@@ -1,103 +1,34 @@
package com.reajason.javaweb.integration.probe.resin;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Resin318ContainerTest {
public static final String imageName = "reajason/resin:3.1.8-jdk7";
public class Resin318ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.resin("reajason/resin:3.1.8-jdk7", "/usr/local/resin3/webapps/app.war")
.expectedJdkVersion("JDK|1.7.0_17|51")
.targetJdkVersion(Opcodes.V1_7)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/resin3/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@AfterAll
public static void tearDown() {
log.info(container.getLogs());
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.7.0_17|51", data);
@Override
protected GenericContainer<?> getContainer() {
return container;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Resin, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Resin, Opcodes.V1_7);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Resin, Opcodes.V1_7);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
}
@@ -1,97 +1,34 @@
package com.reajason.javaweb.integration.probe.resin;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Resin4058ContainerTest {
public static final String imageName = "reajason/resin:4.0.58";
public class Resin4058ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.resin("reajason/resin:4.0.58", "/usr/local/resin4/webapps/app.war")
.expectedJdkVersion("JDK|1.8.0_342|52")
.targetJdkVersion(Opcodes.V1_8)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/resin4/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_342|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
@Override
protected GenericContainer<?> getContainer() {
return container;
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Resin, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Resin, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Resin, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
}
@@ -1,97 +1,34 @@
package com.reajason.javaweb.integration.probe.resin;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Resin4067ContainerTest {
public static final String imageName = "reajason/resin:4.0.67-jdk11";
public class Resin4067ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.resin("reajason/resin:4.0.67-jdk11", "/usr/local/resin4/webapps/app.war")
.expectedJdkVersion("JDK|11.0.16|55")
.targetJdkVersion(Opcodes.V11)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/resin4/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|11.0.16|55", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
@Override
protected GenericContainer<?> getContainer() {
return container;
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Resin, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Resin, Opcodes.V11);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Resin, Opcodes.V11);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
}
@@ -1,57 +1,34 @@
package com.reajason.javaweb.integration.probe.springwebflux;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import com.reajason.javaweb.integration.ContainerTool;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.images.builder.ImageFromDockerfile;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromSpringBoot;
import static com.reajason.javaweb.integration.ContainerTool.springBoot2WebfluxDockerfile;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/22
*/
@Testcontainers
@Slf4j
public class SpringBoot2WebFluxContainerTest {
public static final String imageName = "springboot2-webflux";
public class SpringBoot2WebFluxContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig
.springwebflux("eclipse-temurin:8u472-b08-jdk", ContainerTool.springBoot2WebfluxJarFile)
.expectedJdkVersion("JDK|1.8.0_472|52")
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(new ImageFromDockerfile()
.withDockerfile(springBoot2WebfluxDockerfile))
.waitingFor(Wait.forHttp("/test"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_472|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.SpringWebFlux, data);
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,57 +1,34 @@
package com.reajason.javaweb.integration.probe.springwebflux;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import com.reajason.javaweb.integration.ContainerTool;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.images.builder.ImageFromDockerfile;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromSpringBoot;
import static com.reajason.javaweb.integration.ContainerTool.springBoot3WebfluxDockerfile;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/22
*/
@Testcontainers
@Slf4j
public class SpringBoot3WebFluxContainerTest {
public static final String imageName = "springboot3-webflux";
public class SpringBoot3WebFluxContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig
.springwebflux("eclipse-temurin:17.0.17_10-jdk", ContainerTool.springBoot3WebfluxJarFile)
.expectedJdkVersion("JDK|17.0.17|61")
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(new ImageFromDockerfile()
.withDockerfile(springBoot3WebfluxDockerfile))
.waitingFor(Wait.forHttp("/test"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|17.0.17|61", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.SpringWebFlux, data);
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,80 +1,36 @@
package com.reajason.javaweb.integration.probe.springwebmvc;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.ContainerTool;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.images.builder.ImageFromDockerfile;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromSpringBoot;
import static com.reajason.javaweb.integration.ContainerTool.springBoot1Dockerfile;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/22
*/
@Testcontainers
@Slf4j
public class SpringBoot1ContainerTest {
public static final String imageName = "springboot1";
public class SpringBoot1ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig
.springboot("eclipse-temurin:8u472-b08-jdk", ContainerTool.springBoot1JarFile)
.expectedJdkVersion("JDK|1.8.0_472|52")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(new ImageFromDockerfile()
.withDockerfile(springBoot1Dockerfile))
.waitingFor(Wait.forHttp("/test"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_472|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
@Override
protected GenericContainer<?> getContainer() {
return container;
}
@Test
void testServerDetection() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Tomcat, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrlFromSpringBoot(container);
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBodySpring() {
String url = getUrlFromSpringBoot(container);
ProbeAssertion.responseCommandIsOk(url, Server.SpringWebMvc, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrlFromSpringBoot(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Tomcat, Opcodes.V1_6);
}
}
}
@@ -1,81 +1,36 @@
package com.reajason.javaweb.integration.probe.springwebmvc;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.ContainerTool;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.images.builder.ImageFromDockerfile;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromSpringBoot;
import static com.reajason.javaweb.integration.ContainerTool.springBoot2Dockerfile;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/22
*/
@Testcontainers
@Slf4j
public class SpringBoot2ContainerTest {
public static final String imageName = "springboot2";
public class SpringBoot2ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig
.springboot("eclipse-temurin:8u472-b08-jdk", ContainerTool.springBoot2JarFile)
.expectedJdkVersion("JDK|1.8.0_472|52")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(new ImageFromDockerfile()
.withDockerfile(springBoot2Dockerfile))
.waitingFor(Wait.forHttp("/test"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_472|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Tomcat, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrlFromSpringBoot(container);
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBodySpring() {
String url = getUrlFromSpringBoot(container);
ProbeAssertion.responseCommandIsOk(url, Server.SpringWebMvc, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrlFromSpringBoot(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Tomcat, Opcodes.V1_6);
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,74 +1,37 @@
package com.reajason.javaweb.integration.probe.springwebmvc;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.ContainerTool;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.images.builder.ImageFromDockerfile;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromSpringBoot;
import static com.reajason.javaweb.integration.ContainerTool.springBoot2JettyDockerfile;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/22
*/
@Testcontainers
@Slf4j
public class SpringBoot2JettyContainerTest {
public static final String imageName = "springboot2-jetty";
public class SpringBoot2JettyContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig
.springbootJetty("eclipse-temurin:8u472-b08-jdk", ContainerTool.springBoot2JettyJarFile)
.expectedJdkVersion("JDK|1.8.0_472|52")
.targetJdkVersion(Opcodes.V1_6)
.supportsSpringWebMvc(false)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(new ImageFromDockerfile()
.withDockerfile(springBoot2JettyDockerfile))
.waitingFor(Wait.forHttp("/test"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_472|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Jetty, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrlFromSpringBoot(container);
ProbeAssertion.responseCommandIsOk(url, Server.Jetty, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrlFromSpringBoot(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Jetty, Opcodes.V1_6);
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,73 +1,37 @@
package com.reajason.javaweb.integration.probe.springwebmvc;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.ContainerTool;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.images.builder.ImageFromDockerfile;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromSpringBoot;
import static com.reajason.javaweb.integration.ContainerTool.springBoot2UndertowDockerfile;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/22
*/
@Testcontainers
@Slf4j
public class SpringBoot2UndertowContainerTest {
public static final String imageName = "springboot2-undertow";
public class SpringBoot2UndertowContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig
.springbootUndertow("eclipse-temurin:8u472-b08-jdk", ContainerTool.springBoot2UndertowJarFile)
.expectedJdkVersion("JDK|1.8.0_472|52")
.targetJdkVersion(Opcodes.V1_6)
.supportsSpringWebMvc(false)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(new ImageFromDockerfile()
.withDockerfile(springBoot2UndertowDockerfile))
.waitingFor(Wait.forHttp("/test"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_472|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Undertow, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrlFromSpringBoot(container);
ProbeAssertion.responseCommandIsOk(url, Server.Undertow, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrlFromSpringBoot(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Undertow, Opcodes.V1_6);
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,81 +1,48 @@
package com.reajason.javaweb.integration.probe.springwebmvc;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junitpioneer.jupiter.RetryingTest;
import org.objectweb.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.springBoot2WarFile;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/22
*/
@Testcontainers
@Slf4j
public class SpringBoot2WarContainerTest {
public static final String imageName = "tomcat:8-jre8";
public class SpringBoot2WarContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.tomcat("tomcat:8-jre8")
.warFile(springBoot2WarFile)
.expectedJdkVersion("JRE|1.8.0_402|52")
.targetJdkVersion(Opcodes.V1_6)
.supportsSpringWebMvc(true)
.supportsScriptEngine(false)
.supportsFilterProbe(false)
.supportsBytecodeWithoutPrefix(false)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(springBoot2WarFile, "/usr/local/tomcat/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Override
protected GenericContainer<?> getContainer() {
return container;
}
@Override
@RetryingTest(3)
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|1.8.0_402|52", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Tomcat, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBodySpring() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.SpringWebMvc, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Tomcat, Opcodes.V1_6);
protected void testJDK() {
doTestJDK();
}
}
@@ -1,80 +1,36 @@
package com.reajason.javaweb.integration.probe.springwebmvc;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.ContainerTool;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.images.builder.ImageFromDockerfile;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromSpringBoot;
import static com.reajason.javaweb.integration.ContainerTool.springBoot3Dockerfile;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/22
*/
@Testcontainers
@Slf4j
public class SpringBoot3ContainerTest {
public static final String imageName = "springboot3";
public class SpringBoot3ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig
.springboot("eclipse-temurin:17.0.17_10-jdk", ContainerTool.springBoot3JarFile)
.expectedJdkVersion("JDK|17.0.17|61")
.targetJdkVersion(Opcodes.V17)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(new ImageFromDockerfile()
.withDockerfile(springBoot3Dockerfile))
.waitingFor(Wait.forHttp("/test"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|17.0.17|61", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromSpringBoot(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Tomcat, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrlFromSpringBoot(container);
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V17);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBodySpring() {
String url = getUrlFromSpringBoot(container);
ProbeAssertion.responseCommandIsOk(url, Server.SpringWebMvc, Opcodes.V17);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrlFromSpringBoot(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Tomcat, Opcodes.V17);
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -2,72 +2,59 @@ package com.reajason.javaweb.integration.probe.struct2;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.struct2WarFile;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Struct2ContainerTest {
public static final String imageName = "tomcat:8-jre8";
public class Struct2ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.tomcat("tomcat:8-jre8")
.warFile(struct2WarFile)
.expectedJdkVersion("JRE|1.8.0_402|52")
.targetJdkVersion(Opcodes.V1_8)
.supportsBytecode(false)
.supportsFilterProbe(false)
.supportsBytecodeWithoutPrefix(false)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(struct2WarFile, "/usr/local/tomcat/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|1.8.0_402|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Override
protected GenericContainer<?> getContainer() {
return container;
}
@Override
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Tomcat, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
protected void testCommandReqHeaderResponseBody() {
String url = getUrl();
ProbeAssertion.responseCommandIsOk(url, Server.Struct2, Opcodes.V1_8);
}
@Override
@Test
@SneakyThrows
void testScriptEngineReqHeaderResponseBody() {
String url = getUrl(container);
protected void testScriptEngineReqHeaderResponseBody() {
String url = getUrl();
ProbeAssertion.responseScriptEngineIsOk(url, Server.Struct2, Opcodes.V1_8);
}
}
}
@@ -1,112 +1,35 @@
package com.reajason.javaweb.integration.probe.tomcat;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Tomcat10ContainerTest {
public static final String imageName = "tomcat:10.1.44-jre11";
public class Tomcat10ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.tomcatJakarta("tomcat:10.1.44-jre11")
.expectedJdkVersion("JRE|11.0.28|55")
.targetJdkVersion(Opcodes.V11)
.supportsScriptEngine(true)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warJakartaFile, "/usr/local/tomcat/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@AfterAll
public static void tearDown() {
log.info(container.getLogs());
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|11.0.28|55", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Tomcat, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V11);
}
@Test
@SneakyThrows
void testScriptEngineReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseScriptEngineIsOk(url, Server.Tomcat, Opcodes.V11);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Tomcat, Opcodes.V11);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
log.info(data);
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,99 +1,34 @@
package com.reajason.javaweb.integration.probe.tomcat;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Tomcat11ContainerTest {
public class Tomcat11ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.tomcatJakarta("tomcat:11.0.10-jre17")
.expectedJdkVersion("JRE|17.0.16|61")
.targetJdkVersion(Opcodes.V17)
.build();
public static final String imageName = "tomcat:11.0.10-jre17";
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warJakartaFile, "/usr/local/tomcat/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|17.0.16|61", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Tomcat, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V17);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Tomcat, Opcodes.V17);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
log.info(data);
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,100 +1,34 @@
package com.reajason.javaweb.integration.probe.tomcat;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Tomcat11JRE21ContainerTest {
public class Tomcat11JRE21ContainerTest extends AbstractProbeContainerTest {
public static final String imageName = "tomcat:11.0.10-jre21";
private static final ProbeTestConfig CONFIG = ProbeTestConfig.tomcatJakarta("tomcat:11.0.10-jre21")
.expectedJdkVersion("JRE|21.0.8|65")
.targetJdkVersion(Opcodes.V21)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warJakartaFile, "/usr/local/tomcat/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|21.0.8|65", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Tomcat, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V21);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Tomcat, Opcodes.V21);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
log.info(data);
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,112 +1,42 @@
package com.reajason.javaweb.integration.probe.tomcat;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junitpioneer.jupiter.RetryingTest;
import org.objectweb.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Tomcat5ContainerTest {
public static final String imageName = "reajason/tomcat:5-jdk6";
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/tomcat/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public class Tomcat5ContainerTest extends AbstractProbeContainerTest {
@AfterAll
public static void tearDown() {
log.info(container.getLogs());
private static final ProbeTestConfig CONFIG = ProbeTestConfig.tomcat("reajason/tomcat:5-jdk6")
.expectedJdkVersion("JDK|1.6.0_45|50")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Override
protected GenericContainer<?> getContainer() {
return container;
}
// 存在首次请求,Tomcat 无法通过 req.getParameter 拿到参数的情况,因此需要重试
@Override
@RetryingTest(3)
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.6.0_45|50", data);
protected void testJDK() {
doTestJDK();
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Tomcat, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testScriptEngineReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseScriptEngineIsOk(url, Server.Tomcat, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Tomcat, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
}
@@ -1,104 +1,34 @@
package com.reajason.javaweb.integration.probe.tomcat;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Tomcat6ContainerTest {
public static final String imageName = "reajason/tomcat:6-jdk6";
public class Tomcat6ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.tomcat("reajason/tomcat:6-jdk6")
.expectedJdkVersion("JDK|1.6.0_45|50")
.targetJdkVersion(Opcodes.V1_6)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/tomcat/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.6.0_45|50", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
@Override
protected GenericContainer<?> getContainer() {
return container;
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Tomcat, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testScriptEngineReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseScriptEngineIsOk(url, Server.Tomcat, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Tomcat, Opcodes.V1_6);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
}
@@ -1,106 +1,41 @@
package com.reajason.javaweb.integration.probe.tomcat;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junitpioneer.jupiter.RetryingTest;
import org.objectweb.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Tomcat7ContainerTest {
public static final String imageName = "tomcat:7.0.85-jre7";
public class Tomcat7ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.tomcat("tomcat:7.0.85-jre7")
.expectedJdkVersion("JRE|1.7.0_171|51")
.targetJdkVersion(Opcodes.V1_7)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/tomcat/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Override
protected GenericContainer<?> getContainer() {
return container;
}
@Override
@RetryingTest(3)
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|1.7.0_171|51", data);
protected void testJDK() {
doTestJDK();
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Tomcat, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V1_7);
}
@Test
@SneakyThrows
void testScriptEngineReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseScriptEngineIsOk(url, Server.Tomcat, Opcodes.V1_7);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Tomcat, Opcodes.V1_7);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
}
@@ -1,108 +1,34 @@
package com.reajason.javaweb.integration.probe.tomcat;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Tomcat8ContainerTest {
public static final String imageName = "tomcat:8-jre8";
public class Tomcat8ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.tomcat("tomcat:8-jre8")
.expectedJdkVersion("JRE|1.8.0_402|52")
.targetJdkVersion(Opcodes.V1_8)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/tomcat/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|1.8.0_402|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(
Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"),
data);
@Override
protected GenericContainer<?> getContainer() {
return container;
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Tomcat, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testScriptEngineReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseScriptEngineIsOk(url, Server.Tomcat, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Tomcat, Opcodes.V1_8);
ProbeAssertion.responseBytecodeWithoutPrefixIsOk(url, Server.Tomcat, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
}
@@ -1,98 +1,42 @@
package com.reajason.javaweb.integration.probe.tomcat;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junitpioneer.jupiter.RetryingTest;
import org.objectweb.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Tomcat9ContainerTest {
public static final String imageName = "tomcat:9.0.8-jre9";
public class Tomcat9ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.tomcat("tomcat:9.0.8-jre9")
.expectedJdkVersion("JRE|9.0.4|53")
.targetJdkVersion(Opcodes.V9)
.supportsScriptEngine(false)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/usr/local/tomcat/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Override
protected GenericContainer<?> getContainer() {
return container;
}
@Override
@RetryingTest(3)
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|9.0.4|53", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Tomcat, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V9);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Tomcat, Opcodes.V9);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
protected void testJDK() {
doTestJDK();
}
}
@@ -1,103 +1,36 @@
package com.reajason.javaweb.integration.probe.weblogic;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWebLogic;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/24
*/
@Testcontainers
@Slf4j
public class WebLogic1036ContainerTest {
public static final String imageName = "reajason/weblogic:10.3.6";
public class WebLogic1036ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.weblogic(
"reajason/weblogic:10.3.6",
"/opt/oracle/wls1036/user_projects/domains/base_domain/autodeploy/app.war")
.expectedJdkVersion("JDK|1.8.0_342|52")
.targetJdkVersion(Opcodes.V1_8)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/opt/oracle/wls1036/user_projects/domains/base_domain/autodeploy/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(7001);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@AfterAll
public static void tearDown() {
log.info(container.getLogs());
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrlFromWebLogic(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_342|52", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromWebLogic(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromWebLogic(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.WebLogic, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrlFromWebLogic(container);
ProbeAssertion.responseCommandIsOk(url, Server.WebLogic, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrlFromWebLogic(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.WebLogic, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrlFromWebLogic(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebLogic));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrlFromWebLogic(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebLogic, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebLogic));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,103 +1,36 @@
package com.reajason.javaweb.integration.probe.weblogic;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWebLogic;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/24
*/
@Testcontainers
@Slf4j
public class WebLogic12214ContainerTest {
public static final String imageName = "reajason/weblogic:12.2.1.4";
public class WebLogic12214ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.weblogic(
"reajason/weblogic:12.2.1.4",
"/u01/oracle/user_projects/domains/domain1/autodeploy/app.war")
.expectedJdkVersion("JDK|1.8.0_411|52")
.targetJdkVersion(Opcodes.V1_8)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/u01/oracle/user_projects/domains/domain1/autodeploy/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(7001);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@AfterAll
public static void tearDown() {
System.out.println(container.getLogs());
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrlFromWebLogic(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_411|52", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromWebLogic(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromWebLogic(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.WebLogic, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrlFromWebLogic(container);
ProbeAssertion.responseCommandIsOk(url, Server.WebLogic, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrlFromWebLogic(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.WebLogic, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrlFromWebLogic(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebLogic));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrlFromWebLogic(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebLogic, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebLogic));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,97 +1,36 @@
package com.reajason.javaweb.integration.probe.weblogic;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWebLogic;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/24
*/
@Testcontainers
@Slf4j
public class WebLogic14110ContainerTest {
public static final String imageName = "reajason/weblogic:14.1.1.0";
public class WebLogic14110ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.weblogic(
"reajason/weblogic:14.1.1.0",
"/u01/oracle/user_projects/domains/domain1/autodeploy/app.war")
.expectedJdkVersion("JDK|1.8.0_391|52")
.targetJdkVersion(Opcodes.V1_8)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/u01/oracle/user_projects/domains/domain1/autodeploy/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(7001);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrlFromWebLogic(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_391|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromWebLogic(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromWebLogic(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.WebLogic, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrlFromWebLogic(container);
ProbeAssertion.responseCommandIsOk(url, Server.WebLogic, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrlFromWebLogic(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.WebLogic, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrlFromWebLogic(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebLogic));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrlFromWebLogic(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebLogic, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebLogic));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -0,0 +1,36 @@
package com.reajason.javaweb.integration.probe.weblogic;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
/**
* @author ReaJason
* @since 2024/12/24
*/
@Testcontainers
public class WebLogic14120ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.weblogic(
"reajason/weblogic:14.1.2.0-jdk17",
"/u01/oracle/user_projects/domains/domain1/autodeploy/app.war")
.expectedJdkVersion("JDK|1.8.0_391|52")
.targetJdkVersion(Opcodes.V17)
.build();
@Container
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,106 +1,40 @@
package com.reajason.javaweb.integration.probe.websphere;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.time.Duration;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/21
*/
@Testcontainers
@Slf4j
public class OpenLiberty18ContainerTest {
public static final String imageName = "open-liberty:18.0.0.4-webProfile8";
public class OpenLiberty18ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig
.openLiberty("open-liberty:18.0.0.4-webProfile8")
.expectedJdkVersion("JRE|1.8.0_211|52")
.targetJdkVersion(Opcodes.V1_8)
.waitStrategy(Wait.forHttp("/app/").forPort(9080).withStartupTimeout(Duration.ofMinutes(5)))
.privilegedMode(true)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/config/dropins/app.war")
.waitingFor(Wait.forHttp("/app/").forPort(9080).withStartupTimeout(Duration.ofMinutes(5)))
.withExposedPorts(9080)
.withPrivilegedMode(true);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@AfterAll
public static void tearDown() {
System.out.println(container.getLogs());
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|1.8.0_211|52", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.WebSphere, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrlFromWAS(container);
ProbeAssertion.responseCommandIsOk(url, Server.WebSphere, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrlFromWAS(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.WebSphere, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrlFromWAS(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,107 +1,39 @@
package com.reajason.javaweb.integration.probe.websphere;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.time.Duration;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/21
*/
@Testcontainers
@Slf4j
public class OpenLiberty20ContainerTest {
public static final String imageName = "open-liberty:20.0.0.12-full-java8-openj9";
public class OpenLiberty20ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.openLiberty("open-liberty:20.0.0.12-full-java8-openj9")
.expectedJdkVersion("JRE|1.8.0_292|52")
.targetJdkVersion(Opcodes.V1_8)
.waitStrategy(Wait.forHttp("/app/").forPort(9080).withStartupTimeout(Duration.ofMinutes(5)))
.privilegedMode(true)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/config/dropins/app.war")
.waitingFor(Wait.forHttp("/app/").forPort(9080).withStartupTimeout(Duration.ofMinutes(5)))
.withExposedPorts(9080)
.withPrivilegedMode(true);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@AfterAll
public static void tearDown() {
System.out.println(container.getLogs());
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|1.8.0_292|52", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.WebSphere, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrlFromWAS(container);
ProbeAssertion.responseCommandIsOk(url, Server.WebSphere, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrlFromWAS(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.WebSphere, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrlFromWAS(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
log.info(data);
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,106 +1,39 @@
package com.reajason.javaweb.integration.probe.websphere;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.time.Duration;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/21
*/
@Testcontainers
@Slf4j
public class OpenLiberty22ContainerTest {
public static final String imageName = "open-liberty:22.0.0.12-full-java11-openj9";
public class OpenLiberty22ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.openLiberty("open-liberty:22.0.0.12-full-java11-openj9")
.expectedJdkVersion("JRE|11.0.19|55")
.targetJdkVersion(Opcodes.V1_8)
.waitStrategy(Wait.forHttp("/app/").forPort(9080).withStartupTimeout(Duration.ofMinutes(5)))
.privilegedMode(true)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/config/dropins/app.war")
.waitingFor(Wait.forHttp("/app/").forPort(9080).withStartupTimeout(Duration.ofMinutes(5)))
.withExposedPorts(9080)
.withPrivilegedMode(true);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@AfterAll
public static void tearDown() {
System.out.println(container.getLogs());
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|11.0.19|55", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.WebSphere, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrlFromWAS(container);
ProbeAssertion.responseCommandIsOk(url, Server.WebSphere, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrlFromWAS(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.WebSphere, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrlFromWAS(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,106 +1,39 @@
package com.reajason.javaweb.integration.probe.websphere;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.time.Duration;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/21
*/
@Testcontainers
@Slf4j
public class OpenLiberty25ContainerTest {
public static final String imageName = "open-liberty:25.0.0.12-full-java17-openj9";
public class OpenLiberty25ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.openLiberty("open-liberty:25.0.0.12-full-java17-openj9")
.expectedJdkVersion("JRE|17.0.17|61")
.targetJdkVersion(Opcodes.V1_8)
.waitStrategy(Wait.forHttp("/app/").forPort(9080).withStartupTimeout(Duration.ofMinutes(5)))
.privilegedMode(true)
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/config/dropins/app.war")
.waitingFor(Wait.forHttp("/app/").forPort(9080).withStartupTimeout(Duration.ofMinutes(5)))
.withExposedPorts(9080)
.withPrivilegedMode(true);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@AfterAll
public static void tearDown() {
System.out.println(container.getLogs());
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|17.0.17|61", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.WebSphere, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrlFromWAS(container);
ProbeAssertion.responseCommandIsOk(url, Server.WebSphere, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrlFromWAS(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.WebSphere, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrlFromWAS(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,105 +1,40 @@
package com.reajason.javaweb.integration.probe.websphere;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.time.Duration;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/21
*/
@Testcontainers
@Slf4j
public class WebSphere855ContainerTest {
public static final String imageName = "reajason/websphere:8.5.5.24";
public class WebSphere855ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.websphere(
"reajason/websphere:8.5.5.24",
"/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/monitoredDeployableApps/servers/server1/app.war")
.expectedJdkVersion("JDK|1.8.0_371|52")
.targetJdkVersion(Opcodes.V1_8)
.waitStrategy(Wait.forHttp("/app/").forPort(9080).withStartupTimeout(Duration.ofMinutes(5)))
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/monitoredDeployableApps/servers/server1/app.war")
.waitingFor(Wait.forHttp("/app/").forPort(9080).withStartupTimeout(Duration.ofMinutes(5)))
.withExposedPorts(9080)
.withPrivilegedMode(true);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@AfterAll
public static void tearDown() {
System.out.println(container.getLogs());
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
void testJDK() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_371|52", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.WebSphere, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrlFromWAS(container);
ProbeAssertion.responseCommandIsOk(url, Server.WebSphere, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrlFromWAS(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.WebSphere, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrlFromWAS(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,100 +1,40 @@
package com.reajason.javaweb.integration.probe.websphere;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.time.Duration;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/21
*/
@Testcontainers
@Slf4j
public class WebSphere905ContainerTest {
public static final String imageName = "reajason/websphere:9.0.5.17";
public class WebSphere905ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.websphere(
"reajason/websphere:9.0.5.17",
"/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/monitoredDeployableApps/servers/server1/app.war")
.expectedJdkVersion("JDK|1.8.0_381|52")
.targetJdkVersion(Opcodes.V1_8)
.waitStrategy(Wait.forHttp("/app/").forPort(9080).withStartupTimeout(Duration.ofMinutes(5)))
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/monitoredDeployableApps/servers/server1/app.war")
.waitingFor(Wait.forHttp("/app/").forPort(9080).withStartupTimeout(Duration.ofMinutes(5)))
.withExposedPorts(9080)
.withPrivilegedMode(true);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_381|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.WebSphere, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrlFromWAS(container);
ProbeAssertion.responseCommandIsOk(url, Server.WebSphere, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrlFromWAS(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.WebSphere, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrlFromWAS(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,86 +1,42 @@
package com.reajason.javaweb.integration.probe.websphere7;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.time.Duration;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/21
*/
@Testcontainers
@Slf4j
public class WebSphere700ContainerTest {
public static final String imageName = "reajason/websphere:7.0.0.21";
public class WebSphere700ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.websphere(
"reajason/websphere:7.0.0.21",
"/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/monitoredDeployableApps/servers/server1/app.war")
.expectedJdkVersion("JDK|1.6.0|50")
.targetJdkVersion(Opcodes.V1_6)
.supportsCommand(false)
.supportsBytecode(false)
.waitStrategy(Wait.forHttp("/app/").forPort(9080).withStartupTimeout(Duration.ofMinutes(5)))
.build();
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/monitoredDeployableApps/servers/server1/app.war")
.waitingFor(Wait.forHttp("/app/").forPort(9080).withStartupTimeout(Duration.ofMinutes(5)))
.withExposedPorts(9080)
.withPrivilegedMode(true);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.6.0|50", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.WebSphere, data);
}
@Test
void testFilterProbe() {
String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrlFromWAS(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,97 +1,35 @@
package com.reajason.javaweb.integration.probe.wildfly;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/10
*/
@Slf4j
@Testcontainers
public class Wildfly18ContainerTest {
public static final String imageName = "jboss/wildfly:18.0.1.Final";
public class Wildfly18ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig
.wildfly("jboss/wildfly:18.0.1.Final")
.expectedJdkVersion("JDK|11.0.5|55")
.targetJdkVersion(Opcodes.V11)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/opt/jboss/wildfly/standalone/deployments/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|11.0.5|55", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Undertow, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Undertow, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Undertow, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Undertow, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,97 +1,34 @@
package com.reajason.javaweb.integration.probe.wildfly;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/10
*/
@Slf4j
@Testcontainers
public class Wildfly23ContainerTest {
public static final String imageName = "jboss/wildfly:23.0.2.Final";
public class Wildfly23ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.wildfly("jboss/wildfly:23.0.2.Final")
.expectedJdkVersion("JDK|11.0.8|55")
.targetJdkVersion(Opcodes.V11)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/opt/jboss/wildfly/standalone/deployments/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|11.0.8|55", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Undertow, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Undertow, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Undertow, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Undertow, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,97 +1,34 @@
package com.reajason.javaweb.integration.probe.wildfly;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/10
*/
@Slf4j
@Testcontainers
public class Wildfly30ContainerTest {
public static final String imageName = "quay.io/wildfly/wildfly:30.0.1.Final-jdk17";
public class Wildfly30ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.wildflyJakarta("quay.io/wildfly/wildfly:30.0.1.Final-jdk17")
.expectedJdkVersion("JDK|17.0.9|61")
.targetJdkVersion(Opcodes.V17)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warJakartaFile, "/opt/jboss/wildfly/standalone/deployments/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|17.0.9|61", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Undertow, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Undertow, Opcodes.V17);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Undertow, Opcodes.V17);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Undertow, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,97 +1,34 @@
package com.reajason.javaweb.integration.probe.wildfly;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/10
*/
@Slf4j
@Testcontainers
public class Wildfly36ContainerTest {
public static final String imageName = "quay.io/wildfly/wildfly:36.0.0.Final-jdk21";
public class Wildfly36ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig.wildflyJakarta("quay.io/wildfly/wildfly:36.0.0.Final-jdk21")
.expectedJdkVersion("JDK|21.0.6|65")
.targetJdkVersion(Opcodes.V21)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warJakartaFile, "/opt/jboss/wildfly/standalone/deployments/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|21.0.6|65", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Undertow, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Undertow, Opcodes.V17);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Undertow, Opcodes.V17);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Undertow, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}
@@ -1,33 +1,12 @@
package com.reajason.javaweb.integration.probe.wildfly;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import com.reajason.javaweb.integration.probe.AbstractProbeContainerTest;
import com.reajason.javaweb.integration.probe.ProbeTestConfig;
import net.bytebuddy.jar.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* <a href="https://hub.docker.com/r/jboss/wildfly/tags">Wildfly - DockerHub</a>
* <a href="https://quay.io/repository/wildfly/wildfly?tab=tags">Wildfly - Quay</a>
@@ -35,66 +14,25 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
* @author ReaJason
* @since 2024/12/10
*/
@Slf4j
@Testcontainers
public class Wildfly9ContainerTest {
public static final String imageName = "jboss/wildfly:9.0.1.Final";
public class Wildfly9ContainerTest extends AbstractProbeContainerTest {
private static final ProbeTestConfig CONFIG = ProbeTestConfig
.wildfly("jboss/wildfly:9.0.1.Final")
.expectedJdkVersion("JDK|1.8.0_191|52")
.targetJdkVersion(Opcodes.V1_8)
.build();
@Container
public static final GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warFile, "/opt/jboss/wildfly/standalone/deployments/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
public static final GenericContainer<?> container = buildContainer(CONFIG);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JDK|1.8.0_191|52", data);
@Override
protected ProbeTestConfig getConfig() {
return CONFIG;
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Undertow, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Undertow, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.Undertow, Opcodes.V1_8);
}
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Undertow, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
@Override
protected GenericContainer<?> getContainer() {
return container;
}
}