diff --git a/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/GlassFishFilterProbe.java b/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/GlassFishFilterProbe.java index a9e7b28f..4458a44a 100644 --- a/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/GlassFishFilterProbe.java +++ b/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/GlassFishFilterProbe.java @@ -10,78 +10,92 @@ import java.util.*; * @author ReaJason */ public class GlassFishFilterProbe { + @Override public String toString() { - String msg = ""; + StringBuilder msg = new StringBuilder(); Map>> allFiltersData = new LinkedHashMap>>(); Set contexts = null; try { contexts = getContext(); } catch (Throwable throwable) { - msg += "context error: " + getErrorMessage(throwable); + msg.append("context error: ").append(getErrorMessage(throwable)); } if (contexts == null || contexts.isEmpty()) { - msg += "context not found\n"; + msg.append("context not found\n"); } else { for (Object context : contexts) { String contextRoot = getContextRoot(context); - List> filters = collectFiltersData(context); - allFiltersData.put(contextRoot, filters); + try { + List> filters = collectFiltersData(context); + allFiltersData.put(contextRoot, filters); + } catch (Throwable e) { + msg.append(contextRoot).append(" failed ").append(getErrorMessage(e)).append("\n"); + } } - msg += formatFiltersData(allFiltersData); + msg.append(formatFiltersData(allFiltersData)); } - return msg; + return msg.toString(); } - private List> collectFiltersData(Object context) { + @SuppressWarnings("unchecked") + private List> collectFiltersData(Object context) throws Exception { Map> aggregatedData = new LinkedHashMap<>(); - try { - List filterMaps = (List) invokeMethod(context, "findFilterMaps"); - if (filterMaps == null || filterMaps.isEmpty()) return Collections.emptyList(); + List filterMaps = (List) invokeMethod(context, "findFilterMaps"); + if (filterMaps == null || filterMaps.isEmpty()) return Collections.emptyList(); - Object[] filterDefs = (Object[]) invokeMethod(context, "findFilterDefs"); - for (Object fm : filterMaps) { - String name = (String) invokeMethod(fm, "getFilterName"); - if (name == null) continue; - if (!aggregatedData.containsKey(name)) { - String filterClass = "N/A"; - if (filterDefs != null) { - for (Object def : filterDefs) { - if (!name.equals(invokeMethod(def, "getFilterName"))) continue; - Class cls = (Class) invokeMethod(def, "getFilterClass"); - if (cls == null) { - Object config = invokeMethod(context, "findFilterConfig", new Class[]{String.class}, new Object[]{name}); - Object filter = config != null ? invokeMethod(config, "getFilter") : null; - if (filter != null) filterClass = filter.getClass().getName(); - } - if (cls != null) filterClass = cls.getName(); - break; - } - } - Map info = new HashMap<>(); - info.put("filterName", name); - info.put("filterClass", filterClass); - info.put("urlPatterns", new LinkedHashSet()); - info.put("servletNames", new LinkedHashSet()); - aggregatedData.put(name, info); - } - Map info = aggregatedData.get(name); - String[] urls = null; - try { - urls = (String[]) invokeMethod(fm, "getURLPatterns"); - } catch (Exception e) { + Object[] filterDefs = (Object[]) invokeMethod(context, "findFilterDefs"); + + for (Object fm : filterMaps) { + String name = (String) invokeMethod(fm, "getFilterName"); + if (name == null) continue; + if (!aggregatedData.containsKey(name)) { + String filterClass = "N/A"; + if (filterDefs != null) { + Object filterDef = invokeMethod(context, "findFilterDef", new Class[]{String.class}, new Object[]{name}); try { - Object urlPattern = invokeMethod(fm, "getURLPattern"); - if (urlPattern instanceof String) { - urls = new String[] { (String) urlPattern }; - } - } catch (Exception ignored) { + filterClass = (String) invokeMethod(filterDef, "getFilterClass"); + } catch (Throwable throwable) { + filterClass = (String) invokeMethod(filterDef, "getFilterClassName"); + } + if (filterClass == null) { + Object filterConfig = invokeMethod(context, "findFilterConfig", new Class[]{String.class}, new Object[]{name}); + Object filter = invokeMethod(filterConfig, "getFilter"); + if (filter != null) filterClass = filter.getClass().getName(); } } - if (urls != null) ((Set) info.get("urlPatterns")).addAll(Arrays.asList(urls)); + Map info = new HashMap<>(); + info.put("filterName", name); + info.put("filterClass", filterClass); + info.put("urlPatterns", new LinkedHashSet()); + info.put("servletNames", new LinkedHashSet()); + aggregatedData.put(name, info); } - } catch (Exception ignored) {} + Map info = aggregatedData.get(name); + String[] urls = null; + try { + urls = (String[]) invokeMethod(fm, "getURLPatterns"); + } catch (Exception e) { + // Tomcat 5 + String urlPattern = (String) invokeMethod(fm, "getURLPattern"); + if (urlPattern != null) { + urls = new String[]{urlPattern}; + } + } + if (urls != null) ((Set) info.get("urlPatterns")).addAll(Arrays.asList(urls)); + String[] servletNames = null; + try { + servletNames = (String[]) invokeMethod(fm, "getServletNames"); + } catch (Exception e) { + // Tomcat 5 + String servletName = (String) invokeMethod(fm, "getServletName"); + if (servletName != null) { + servletNames = new String[]{servletName}; + } + } + if (servletNames != null) ((Set) info.get("servletNames")).addAll(Arrays.asList(servletNames)); + } List> result = new ArrayList<>(); for (Map entry : aggregatedData.values()) { Map finalInfo = new HashMap<>(); @@ -89,6 +103,8 @@ public class GlassFishFilterProbe { finalInfo.put("filterClass", (String) entry.get("filterClass")); Set urls = (Set) entry.get("urlPatterns"); finalInfo.put("urlPatterns", urls.isEmpty() ? "" : urls.toString()); + Set servletNames = (Set) entry.get("servletNames"); + finalInfo.put("servletNames", servletNames.isEmpty() ? "" : servletNames.toString()); result.add(finalInfo); } return result; @@ -111,6 +127,7 @@ public class GlassFishFilterProbe { appendIfPresent(output, "", info.get("filterName"), ""); appendIfPresent(output, " -> ", info.get("filterClass"), ""); appendIfPresent(output, " -> URL:", info.get("urlPatterns"), ""); + appendIfPresent(output, " -> Servlet:", info.get("servletNames"), ""); output.append("\n"); } } diff --git a/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/TomcatFilterProbe.java b/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/TomcatFilterProbe.java index 3ca9fd09..8f0d1f4f 100644 --- a/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/TomcatFilterProbe.java +++ b/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/TomcatFilterProbe.java @@ -74,7 +74,10 @@ public class TomcatFilterProbe { urls = (String[]) invokeMethod(fm, "getURLPatterns"); } catch (Exception e) { // Tomcat 5 - urls = new String[]{(String) invokeMethod(fm, "getURLPattern")}; + String urlPattern = (String) invokeMethod(fm, "getURLPattern"); + if (urlPattern != null) { + urls = new String[]{urlPattern}; + } } if (urls != null) ((Set) info.get("urlPatterns")).addAll(Arrays.asList(urls)); String[] servletNames = null; @@ -82,7 +85,10 @@ public class TomcatFilterProbe { servletNames = (String[]) invokeMethod(fm, "getServletNames"); } catch (Exception e) { // Tomcat 5 - servletNames = new String[]{(String) invokeMethod(fm, "getServletName")}; + String servletName = (String) invokeMethod(fm, "getServletName"); + if (servletName != null) { + servletNames = new String[]{servletName}; + } } if (servletNames != null) ((Set) info.get("servletNames")).addAll(Arrays.asList(servletNames)); } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/DetectionTool.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/DetectionTool.java index a5005f6a..72cb11e7 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/DetectionTool.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/DetectionTool.java @@ -35,14 +35,6 @@ public class DetectionTool { return getBase64Class(ServerProbe.class); } - public static String getTomcatFilterProbe() { - return getBase64Class(TomcatFilterProbe.class); - } - - public static String getJettyFilterProbe() { - return getBase64Class(JettyFilterProbe.class); - } - public static String getResinFilterProbe() { return getBase64Class(ResinFilterProbe.class); } @@ -51,10 +43,6 @@ public class DetectionTool { return getBase64Class(UndertowFilterProbe.class); } - public static String getGlassFishFilterProbe() { - return getBase64Class(GlassFishFilterProbe.class); - } - public static String getApusicFilterProbe() { return getBase64Class(ApusicFilterProbe.class); } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish3ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish3ContainerTest.java index 1335562f..bdc0e395 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish3ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish3ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.glassfish; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -94,20 +97,17 @@ public class GlassFish3ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("EmptyFilter") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); + MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish4ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish4ContainerTest.java index 18b91097..6c65250b 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish4ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish4ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.glassfish; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -94,20 +97,17 @@ public class GlassFish4ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("EmptyFilter") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); + MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish501ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish501ContainerTest.java index 91eccbda..821a9aa4 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish501ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish501ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.glassfish; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -87,20 +90,17 @@ public class GlassFish501ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("EmptyFilter") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); + MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish510ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish510ContainerTest.java index b5d48544..96eacab2 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish510ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish510ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.glassfish; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -88,20 +91,17 @@ public class GlassFish510ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("EmptyFilter") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); + MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish6ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish6ContainerTest.java index 29ecaf47..b687aaee 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish6ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish6ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.glassfish; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -88,20 +91,17 @@ public class GlassFish6ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("EmptyFilter") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); + MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish7ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish7ContainerTest.java index d6b187b0..58efd5d1 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish7ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish7ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.glassfish; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -94,20 +97,17 @@ public class GlassFish7ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("EmptyFilter") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); + MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss423ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss423ContainerTest.java index 77f8610a..a7e8d6bc 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss423ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss423ContainerTest.java @@ -94,7 +94,7 @@ public class Jboss423ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss510ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss510ContainerTest.java index 5f4bde7a..e429271b 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss510ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss510ContainerTest.java @@ -92,7 +92,7 @@ public class Jboss510ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss610ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss610ContainerTest.java index 76fbc747..95199194 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss610ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss610ContainerTest.java @@ -92,7 +92,7 @@ public class Jboss610ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss711ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss711ContainerTest.java index 75182f2f..9c5f59d2 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss711ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss711ContainerTest.java @@ -92,7 +92,7 @@ public class Jboss711ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty10ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty10ContainerTest.java index bb649960..3fb0e4bf 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty10ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty10ContainerTest.java @@ -97,7 +97,7 @@ public class Jetty10ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V11, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty11ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty11ContainerTest.java index eee0c014..288453eb 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty11ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty11ContainerTest.java @@ -98,7 +98,7 @@ public class Jetty11ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee10ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee10ContainerTest.java index d9da707f..c5213ade 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee10ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee10ContainerTest.java @@ -83,7 +83,7 @@ public class Jetty12ee10ContainerTest { void testFilterFirstInject() { String url = getUrl(container); shellInjectIsOk(url, Server.Jetty, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertThat(filterName, anyOf(startsWith("org.eclipse.jetty.servlet.handlers"))); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee11ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee11ContainerTest.java index 135cf9b4..a5b4a1f9 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee11ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee11ContainerTest.java @@ -83,7 +83,7 @@ public class Jetty12ee11ContainerTest { void testFilterFirstInject() { String url = getUrl(container); shellInjectIsOk(url, Server.Jetty, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertThat(filterName, anyOf(startsWith("org.eclipse.jetty.servlet.handlers"))); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee8ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee8ContainerTest.java index 66c10acf..c907fefd 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee8ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee8ContainerTest.java @@ -90,7 +90,7 @@ public class Jetty12ee8ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee9ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee9ContainerTest.java index 2a240e82..78e1ecb2 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee9ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee9ContainerTest.java @@ -83,7 +83,7 @@ public class Jetty12ee9ContainerTest { void testFilterFirstInject() { String url = getUrl(container); shellInjectIsOk(url, Server.Jetty, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertThat(filterName, anyOf(startsWith("org.eclipse.jetty.servlet.handlers"))); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty61ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty61ContainerTest.java index b0aa14c3..c5391900 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty61ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty61ContainerTest.java @@ -95,7 +95,7 @@ public class Jetty61ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty75ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty75ContainerTest.java index 6428c991..16b34dc1 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty75ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty75ContainerTest.java @@ -89,7 +89,7 @@ public class Jetty75ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty76ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty76ContainerTest.java index 756dcf5c..7b38c53e 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty76ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty76ContainerTest.java @@ -91,7 +91,7 @@ public class Jetty76ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty81ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty81ContainerTest.java index 723266bd..83b9de86 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty81ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty81ContainerTest.java @@ -91,7 +91,7 @@ public class Jetty81ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty92ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty92ContainerTest.java index f3c5e882..754bfb92 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty92ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty92ContainerTest.java @@ -92,7 +92,7 @@ public class Jetty92ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty93ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty93ContainerTest.java index 88b9c4dc..ab29f789 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty93ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty93ContainerTest.java @@ -91,7 +91,7 @@ public class Jetty93ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty94ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty94ContainerTest.java index 2776ee05..bbe11b9c 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty94ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty94ContainerTest.java @@ -91,7 +91,7 @@ public class Jetty94ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara5201ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara5201ContainerTest.java index 759954eb..f29b9682 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara5201ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara5201ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.payara; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -93,20 +96,17 @@ public class Payara5201ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); + MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara520225ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara520225ContainerTest.java index e64b7585..c37788e5 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara520225ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara520225ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.payara; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -87,20 +90,17 @@ public class Payara520225ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); + MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara620222ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara620222ContainerTest.java index 5bd21c54..5f215bfe 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara620222ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara620222ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.payara; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -88,20 +91,17 @@ public class Payara620222ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe()); + MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat10ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat10ContainerTest.java index 5e806b48..e57561a0 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat10ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat10ContainerTest.java @@ -103,7 +103,7 @@ public class Tomcat10ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); log.info(data); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11ContainerTest.java index eeb18983..65f7786c 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11ContainerTest.java @@ -93,7 +93,7 @@ public class Tomcat11ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); log.info(data); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11JRE21ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11JRE21ContainerTest.java index 9454f4bc..5ef6766c 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11JRE21ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11JRE21ContainerTest.java @@ -91,7 +91,7 @@ public class Tomcat11JRE21ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); log.info(data); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat5ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat5ContainerTest.java index 7ffc4566..36353e22 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat5ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat5ContainerTest.java @@ -108,7 +108,7 @@ public class Tomcat5ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat6ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat6ContainerTest.java index 7395fa89..3ee494bb 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat6ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat6ContainerTest.java @@ -99,7 +99,7 @@ public class Tomcat6ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat7ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat7ContainerTest.java index afcb5281..f0afa751 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat7ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat7ContainerTest.java @@ -101,7 +101,7 @@ public class Tomcat7ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat8ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat8ContainerTest.java index 6aed73c6..c37966a9 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat8ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat8ContainerTest.java @@ -103,7 +103,7 @@ public class Tomcat8ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName()); diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat9ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat9ContainerTest.java index d7806d76..f5d62155 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat9ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat9ContainerTest.java @@ -93,7 +93,7 @@ public class Tomcat9ContainerTest { void testFilterFirstInject() { String url = getUrl(container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); assertEquals(filterName, memShellResult.getShellClassName());