From 9d5c5a1ddfdee5c1ccbea892858fdc78b297f0ea Mon Sep 17 00:00:00 2001 From: ReaJason Date: Sun, 11 Jan 2026 03:25:02 +0800 Subject: [PATCH] feat: support servletNameFilter for TomcatFilterProbe --- .../probe/payload/FilterProbeFactory.java | 52 +++++++++ .../payload/filter/TomcatFilterProbe.java | 109 ++++++++++-------- .../reajason/javaweb/utils/CommonUtil.java | 5 +- .../generator/CustomShellGeneratorTest.java | 12 +- .../generator/GodzillaGeneratorTest.java | 2 +- .../javaweb/integration/ShellAssertion.java | 26 +++-- .../integration/probe/DetectionTool.java | 2 +- .../probe/jbossas/Jboss423ContainerTest.java | 14 +-- .../probe/jbossas/Jboss510ContainerTest.java | 14 +-- .../probe/jbossas/Jboss610ContainerTest.java | 14 +-- .../probe/jbossas/Jboss711ContainerTest.java | 14 +-- .../probe/tomcat/Tomcat10ContainerTest.java | 18 ++- .../probe/tomcat/Tomcat11ContainerTest.java | 15 +-- .../tomcat/Tomcat11JRE21ContainerTest.java | 18 ++- .../probe/tomcat/Tomcat5ContainerTest.java | 21 ++-- .../probe/tomcat/Tomcat6ContainerTest.java | 14 +-- .../probe/tomcat/Tomcat7ContainerTest.java | 14 +-- .../probe/tomcat/Tomcat8ContainerTest.java | 14 +-- .../probe/tomcat/Tomcat9ContainerTest.java | 14 +-- ...java => BigIntegerClassLoaderServlet.java} | 2 +- .../Base64ClassLoaderServlet.java | 2 - ...java => BigIntegerClassLoaderServlet.java} | 10 +- .../{jakarta => }/JavaReadObjServlet.java | 3 - .../{jakarta => }/ScriptEngineServlet.java | 2 - .../src/main/java/ServletNameTestFilter.java | 24 ++++ .../{jakarta => }/TestInputStreamServlet.java | 2 - .../java/{jakarta => }/TestReaderServlet.java | 2 - .../main/java/{jakarta => }/TestServlet.java | 2 - .../java/{jakarta => }/UploadServlet.java | 3 - ...yFilter.java => UrlMappingTestFilter.java} | 17 ++- .../src/main/webapp/WEB-INF/web.xml | 40 +++++-- ...java => BigIntegerClassLoaderServlet.java} | 8 +- .../src/main/java/ServletNameTestFilter.java | 23 ++++ ...yFilter.java => UrlMappingTestFilter.java} | 2 +- .../src/main/webapp/WEB-INF/web.xml | 26 ++++- 35 files changed, 348 insertions(+), 212 deletions(-) create mode 100644 generator/src/main/java/com/reajason/javaweb/probe/payload/FilterProbeFactory.java rename vul/vul-webapp-expression/src/main/java/{BigIntegerClassLaoderServlet.java => BigIntegerClassLoaderServlet.java} (95%) rename vul/vul-webapp-jakarta/src/main/java/{jakarta => }/Base64ClassLoaderServlet.java (98%) rename vul/vul-webapp-jakarta/src/main/java/{jakarta/BigIntegerClassLaoderServlet.java => BigIntegerClassLoaderServlet.java} (82%) rename vul/vul-webapp-jakarta/src/main/java/{jakarta => }/JavaReadObjServlet.java (96%) rename vul/vul-webapp-jakarta/src/main/java/{jakarta => }/ScriptEngineServlet.java (97%) create mode 100644 vul/vul-webapp-jakarta/src/main/java/ServletNameTestFilter.java rename vul/vul-webapp-jakarta/src/main/java/{jakarta => }/TestInputStreamServlet.java (98%) rename vul/vul-webapp-jakarta/src/main/java/{jakarta => }/TestReaderServlet.java (98%) rename vul/vul-webapp-jakarta/src/main/java/{jakarta => }/TestServlet.java (97%) rename vul/vul-webapp-jakarta/src/main/java/{jakarta => }/UploadServlet.java (96%) rename vul/vul-webapp-jakarta/src/main/java/{jakarta/EmptyFilter.java => UrlMappingTestFilter.java} (56%) rename vul/vul-webapp/src/main/java/{BigIntegerClassLaoderServlet.java => BigIntegerClassLoaderServlet.java} (83%) create mode 100644 vul/vul-webapp/src/main/java/ServletNameTestFilter.java rename vul/vul-webapp/src/main/java/{EmptyFilter.java => UrlMappingTestFilter.java} (89%) diff --git a/generator/src/main/java/com/reajason/javaweb/probe/payload/FilterProbeFactory.java b/generator/src/main/java/com/reajason/javaweb/probe/payload/FilterProbeFactory.java new file mode 100644 index 00000000..62999446 --- /dev/null +++ b/generator/src/main/java/com/reajason/javaweb/probe/payload/FilterProbeFactory.java @@ -0,0 +1,52 @@ +package com.reajason.javaweb.probe.payload; + +import com.reajason.javaweb.GenerationException; +import com.reajason.javaweb.Server; +import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper; +import com.reajason.javaweb.probe.payload.filter.*; +import com.reajason.javaweb.utils.CommonUtil; +import net.bytebuddy.ByteBuddy; +import net.bytebuddy.dynamic.DynamicType; +import org.apache.commons.codec.binary.Base64; + +/** + * @author ReaJason + * @since 2026/1/11 + */ +public class FilterProbeFactory { + + public static String getBase64ByServer(String server) { + try (DynamicType.Unloaded unloaded = new ByteBuddy() + .redefine(getFilterClass(server)) + .visit(TargetJreVersionVisitorWrapper.DEFAULT) + .name(CommonUtil.generateClassName()).make()) { + return Base64.encodeBase64String(unloaded.getBytes()); + } + } + + + private static Class getFilterClass(String server) { + switch (server) { + case Server.Tomcat: + case Server.JBoss: + case Server.BES: + case Server.TongWeb: + return TomcatFilterProbe.class; + case Server.Jetty: + return JettyFilterProbe.class; + case Server.Apusic: + return ApusicFilterProbe.class; + case Server.GlassFish: + case Server.InforSuite: + return GlassFishFilterProbe.class; + case Server.WebSphere: + return WebSphereFilterProbe.class; + case Server.WebLogic: + return WebLogicFilterProbe.class; + case Server.Undertow: + return UndertowFilterProbe.class; + default: + throw new GenerationException("filterProbe not supported for server: " + server); + } + } +} diff --git a/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/TomcatFilterProbe.java b/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/TomcatFilterProbe.java index aa3999d3..29e9ed5a 100644 --- a/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/TomcatFilterProbe.java +++ b/generator/src/main/java/com/reajason/javaweb/probe/payload/filter/TomcatFilterProbe.java @@ -13,77 +13,83 @@ public class TomcatFilterProbe { @Override public String toString() { - String msg = ""; + StringBuilder msg = new StringBuilder(); Map>> allFiltersData = new LinkedHashMap>>(); Set contexts = null; try { contexts = getContext(); } catch (Throwable throwable) { - msg += "context error: " + getErrorMessage(throwable); + msg.append("context error: ").append(getErrorMessage(throwable)); } if (contexts == null || contexts.isEmpty()) { - msg += "context not found\n"; + msg.append("context not found\n"); } else { for (Object context : contexts) { String contextRoot = getContextRoot(context); - List> filters = collectFiltersData(context); - allFiltersData.put(contextRoot, filters); + try { + List> filters = collectFiltersData(context); + allFiltersData.put(contextRoot, filters); + } catch (Throwable e) { + msg.append(contextRoot).append(" failed ").append(getErrorMessage(e)).append("\n"); + } } - msg += formatFiltersData(allFiltersData); + msg.append(formatFiltersData(allFiltersData)); } - return msg; + return msg.toString(); } - private List> collectFiltersData(Object context) { + @SuppressWarnings("unchecked") + private List> collectFiltersData(Object context) throws Exception { Map> aggregatedData = new LinkedHashMap<>(); - try { - Object[] filterMaps = (Object[]) invokeMethod(context, "findFilterMaps"); - if (filterMaps == null || filterMaps.length == 0) return Collections.emptyList(); + Object[] filterMaps = (Object[]) invokeMethod(context, "findFilterMaps"); + if (filterMaps == null || filterMaps.length == 0) return Collections.emptyList(); - Object[] filterDefs = (Object[]) invokeMethod(context, "findFilterDefs"); + Object[] filterDefs = (Object[]) invokeMethod(context, "findFilterDefs"); - for (Object fm : filterMaps) { - String name = (String) invokeMethod(fm, "getFilterName"); - if (name == null) continue; - if (!aggregatedData.containsKey(name)) { - String filterClass = "N/A"; - if (filterDefs != null) { - for (Object def : filterDefs) { - if (!name.equals(invokeMethod(def, "getFilterName"))) continue; - String cls = (String) invokeMethod(def, "getFilterClass"); - if (cls == null) { - Object config = invokeMethod(context, "findFilterConfig", new Class[]{String.class}, new Object[]{name}); - Object filter = config != null ? invokeMethod(config, "getFilter") : null; - if (filter != null) cls = filter.getClass().getName(); - } - if (cls != null) filterClass = cls; - break; - } - } - Map info = new HashMap<>(); - info.put("filterName", name); - info.put("filterClass", filterClass); - info.put("urlPatterns", new LinkedHashSet()); - info.put("servletNames", new LinkedHashSet()); - aggregatedData.put(name, info); - } - Map info = aggregatedData.get(name); - String[] urls = null; - try { - urls = (String[]) invokeMethod(fm, "getURLPatterns"); - } catch (Exception e) { - try { - Object urlPattern = getFieldValue(fm, "urlPattern"); - if (urlPattern instanceof String) { - urls = new String[] { (String) urlPattern }; - } - } catch (Exception ignored) { + for (Object fm : filterMaps) { + String name = (String) invokeMethod(fm, "getFilterName"); + if (name == null) continue; + if (!aggregatedData.containsKey(name)) { + String filterClass = "N/A"; + if (filterDefs != null) { + Object filterDef = invokeMethod(context, "findFilterDef", new Class[]{String.class}, new Object[]{name}); + filterClass = (String) invokeMethod(filterDef, "getFilterClass"); + if (filterClass == null) { + Object filterConfig = invokeMethod(context, "findFilterConfig", new Class[]{String.class}, new Object[]{name}); + Object filter = invokeMethod(filterConfig, "getFilter"); + if (filter != null) filterClass = filter.getClass().getName(); } } - if (urls != null) ((Set) info.get("urlPatterns")).addAll(Arrays.asList(urls)); + Map info = new HashMap<>(); + info.put("filterName", name); + info.put("filterClass", filterClass); + info.put("urlPatterns", new LinkedHashSet()); + info.put("servletNames", new LinkedHashSet()); + aggregatedData.put(name, info); } - } catch (Exception ignored) {} + Map info = aggregatedData.get(name); + String[] urls = null; + try { + urls = (String[]) invokeMethod(fm, "getURLPatterns"); + } catch (Exception e) { + Object urlPattern = invokeMethod(fm, "getURLPattern"); + if (urlPattern instanceof String) { + urls = new String[]{(String) urlPattern}; + } + } + if (urls != null) ((Set) info.get("urlPatterns")).addAll(Arrays.asList(urls)); + String[] servletNames = null; + try { + servletNames = (String[]) invokeMethod(fm, "getServletNames"); + } catch (Exception e) { + Object servletName = invokeMethod(fm, "getServletName"); + if (servletName instanceof String) { + servletNames = new String[]{(String) servletName}; + } + } + if (servletNames != null) ((Set) info.get("servletNames")).addAll(Arrays.asList(servletNames)); + } List> result = new ArrayList<>(); for (Map entry : aggregatedData.values()) { Map finalInfo = new HashMap<>(); @@ -91,6 +97,8 @@ public class TomcatFilterProbe { finalInfo.put("filterClass", (String) entry.get("filterClass")); Set urls = (Set) entry.get("urlPatterns"); finalInfo.put("urlPatterns", urls.isEmpty() ? "" : urls.toString()); + Set servletNames = (Set) entry.get("servletNames"); + finalInfo.put("servletNames", servletNames.isEmpty() ? "" : servletNames.toString()); result.add(finalInfo); } return result; @@ -113,6 +121,7 @@ public class TomcatFilterProbe { appendIfPresent(output, "", info.get("filterName"), ""); appendIfPresent(output, " -> ", info.get("filterClass"), ""); appendIfPresent(output, " -> URL:", info.get("urlPatterns"), ""); + appendIfPresent(output, " -> Servlet:", info.get("servletNames"), ""); output.append("\n"); } } diff --git a/generator/src/main/java/com/reajason/javaweb/utils/CommonUtil.java b/generator/src/main/java/com/reajason/javaweb/utils/CommonUtil.java index 1b30b4ff..62afddb9 100644 --- a/generator/src/main/java/com/reajason/javaweb/utils/CommonUtil.java +++ b/generator/src/main/java/com/reajason/javaweb/utils/CommonUtil.java @@ -96,8 +96,9 @@ public class CommonUtil { return className.substring(0, className.lastIndexOf(".")); } - public static String generateShellClassName() { - return getRandomPackageName() + ".ErrorHandler"; + public static String generateClassName() { + String randomString = getRandomString(5); + return getRandomPackageName() + ".Error" + randomString.substring(0, 1).toUpperCase() + randomString.substring(1).toLowerCase() + "Handler"; } public static String generateInjectorClassName() { diff --git a/generator/src/test/java/com/reajason/javaweb/memshell/generator/CustomShellGeneratorTest.java b/generator/src/test/java/com/reajason/javaweb/memshell/generator/CustomShellGeneratorTest.java index 9909e716..8f9e052a 100644 --- a/generator/src/test/java/com/reajason/javaweb/memshell/generator/CustomShellGeneratorTest.java +++ b/generator/src/test/java/com/reajason/javaweb/memshell/generator/CustomShellGeneratorTest.java @@ -30,8 +30,8 @@ class CustomShellGeneratorTest { void testListener() { byte[] bytes = new ByteBuddy() .redefine(CommandListener.class) - .name(CommonUtil.generateShellClassName()).make().getBytes(); - String className = CommonUtil.generateShellClassName(); + .name(CommonUtil.generateClassName()).make().getBytes(); + String className = CommonUtil.generateClassName(); ShellConfig shellConfig = ShellConfig.builder() .server(Server.Tomcat) .shellType(ShellType.LISTENER) @@ -52,8 +52,8 @@ class CustomShellGeneratorTest { void testFilter() { byte[] bytes = new ByteBuddy() .subclass(Object.class) - .name(CommonUtil.generateShellClassName()).make().getBytes(); - String className = CommonUtil.generateShellClassName(); + .name(CommonUtil.generateClassName()).make().getBytes(); + String className = CommonUtil.generateClassName(); ShellConfig shellConfig = ShellConfig.builder() .shellType(ShellType.FILTER) .build(); @@ -72,8 +72,8 @@ class CustomShellGeneratorTest { void testValue() { byte[] bytes = new ByteBuddy() .redefine(GodzillaValve.class) - .name(CommonUtil.generateShellClassName()).make().getBytes(); - String className = CommonUtil.generateShellClassName(); + .name(CommonUtil.generateClassName()).make().getBytes(); + String className = CommonUtil.generateClassName(); ShellConfig shellConfig = ShellConfig.builder() .server(Server.BES) .shellType(ShellType.VALVE) diff --git a/generator/src/test/java/com/reajason/javaweb/memshell/generator/GodzillaGeneratorTest.java b/generator/src/test/java/com/reajason/javaweb/memshell/generator/GodzillaGeneratorTest.java index 284604db..9eb0f8a0 100644 --- a/generator/src/test/java/com/reajason/javaweb/memshell/generator/GodzillaGeneratorTest.java +++ b/generator/src/test/java/com/reajason/javaweb/memshell/generator/GodzillaGeneratorTest.java @@ -33,7 +33,7 @@ class GodzillaGeneratorTest { .build(); GodzillaConfig godzillaConfig = GodzillaConfig.builder() .shellClass(GodzillaServlet.class) - .shellClassName(CommonUtil.generateShellClassName()) + .shellClassName(CommonUtil.generateClassName()) .pass("pass") .key("key") .headerName("User-Agent") diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertion.java b/integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertion.java index 18233e97..adf1b9a7 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertion.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertion.java @@ -40,8 +40,7 @@ import java.util.Random; import static com.reajason.javaweb.memshell.ShellTool.*; import static com.reajason.javaweb.utils.CommonUtil.INJECTOR_CLASS_NAMES; import static com.reajason.javaweb.utils.CommonUtil.getRandomString; -import static org.hamcrest.CoreMatchers.anyOf; -import static org.hamcrest.CoreMatchers.containsString; +import static org.hamcrest.CoreMatchers.*; import static org.hamcrest.MatcherAssert.assertThat; import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; import static org.junit.jupiter.api.Assertions.assertTrue; @@ -53,13 +52,13 @@ import static org.junit.jupiter.api.Assertions.assertTrue; @Slf4j public class ShellAssertion { - public static void shellInjectIsOk(String url, String server, String shellType, String shellTool, int targetJdkVersion, Packers packer) { - shellInjectIsOk(url, server, shellType, shellTool, targetJdkVersion, packer, null); + public static MemShellResult shellInjectIsOk(String url, String server, String shellType, String shellTool, int targetJdkVersion, Packers packer) { + return shellInjectIsOk(url, server, shellType, shellTool, targetJdkVersion, packer, null); } @SneakyThrows - public static void shellInjectIsOk(String url, String server, String shellType, String shellTool, int targetJdkVersion, Packers packer, GenericContainer container) { - shellInjectIsOk(url, server, shellType, shellTool, targetJdkVersion, packer, container, null); + public static MemShellResult shellInjectIsOk(String url, String server, String shellType, String shellTool, int targetJdkVersion, Packers packer, GenericContainer container) { + return shellInjectIsOk(url, server, shellType, shellTool, targetJdkVersion, packer, container, null); } @SneakyThrows @@ -85,12 +84,12 @@ public class ShellAssertion { } @SneakyThrows - public static void shellInjectIsOk(String url, String server, String shellType, String shellTool, int targetJdkVersion, Packers packer, GenericContainer appContainer, GenericContainer pythonContainer) { - shellInjectIsOk(url, server, null, shellType, shellTool, targetJdkVersion, packer, appContainer, pythonContainer); + public static MemShellResult shellInjectIsOk(String url, String server, String shellType, String shellTool, int targetJdkVersion, Packers packer, GenericContainer appContainer, GenericContainer pythonContainer) { + return shellInjectIsOk(url, server, null, shellType, shellTool, targetJdkVersion, packer, appContainer, pythonContainer); } @SneakyThrows - public static void shellInjectIsOk(String url, String server, String serverVersion, String shellType, String shellTool, + public static MemShellResult shellInjectIsOk(String url, String server, String serverVersion, String shellType, String shellTool, int targetJdkVersion, Packers packer, GenericContainer appContainer, GenericContainer pythonContainer) { Pair urls = getUrls(url, shellType, shellTool, packer); @@ -104,6 +103,8 @@ public class ShellAssertion { packerResultAndInject(generateResult, url, shellTool, shellType, packer, appContainer); assertShellIsOk(generateResult, shellUrl, shellTool, shellType, appContainer, pythonContainer); + + return generateResult; } @SneakyThrows @@ -492,4 +493,11 @@ public class ShellAssertion { public static void testProbeInject(String url, String server, String shellType, int targetJdkVersion) { testProbeInject(url, server, null, shellType, targetJdkVersion); } + + public static void assertFilterProbeIsRight(String filterInfos) { + assertThat(filterInfos, allOf( + containsString("urlMappingTestFilter -> UrlMappingTestFilter -> URL:[/b64, /test]"), + containsString("servletNameTestFilter -> ServletNameTestFilter -> Servlet:[b64, biginteger]") + )); + } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/DetectionTool.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/DetectionTool.java index ab680d38..a5005f6a 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/DetectionTool.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/DetectionTool.java @@ -18,7 +18,7 @@ public class DetectionTool { public static String getBase64Class(Class clazz) { return Base64.encodeBase64String(new ByteBuddy() .redefine(clazz) - .name(CommonUtil.generateShellClassName()) + .name(CommonUtil.generateClassName()) .visit(TargetJreVersionVisitorWrapper.DEFAULT) .make().getBytes()); } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss423ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss423ContainerTest.java index 48d475bf..77f8610a 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss423ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss423ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.jbossas; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -83,20 +86,17 @@ public class Jboss423ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.JBoss)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.JBoss)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss510ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss510ContainerTest.java index d81476df..5f4bde7a 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss510ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss510ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.jbossas; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -81,20 +84,17 @@ public class Jboss510ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.JBoss)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.JBoss)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss610ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss610ContainerTest.java index 9dcf855d..76fbc747 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss610ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss610ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.jbossas; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -81,20 +84,17 @@ public class Jboss610ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.JBoss)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.JBoss)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss711ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss711ContainerTest.java index a7354543..75182f2f 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss711ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss711ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.jbossas; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -81,20 +84,17 @@ public class Jboss711ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.JBoss)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.JBoss)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat10ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat10ContainerTest.java index 6591fd5a..5e806b48 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat10ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat10ContainerTest.java @@ -2,12 +2,14 @@ package com.reajason.javaweb.integration.probe.tomcat; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; -import com.reajason.javaweb.utils.CommonUtil; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; import org.junit.jupiter.api.AfterAll; @@ -25,8 +27,6 @@ import java.util.List; import static com.reajason.javaweb.integration.ContainerTool.getUrl; import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile; import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk; -import static org.hamcrest.CoreMatchers.*; -import static org.hamcrest.MatcherAssert.assertThat; import static org.junit.jupiter.api.Assertions.assertEquals; /** @@ -95,20 +95,18 @@ public class Tomcat10ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container); + MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container); String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + log.info(data); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.Tomcat)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11ContainerTest.java index 9cc7032e..eeb18983 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.tomcat; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -82,20 +85,18 @@ public class Tomcat11ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V11, Packers.BigInteger, container); + MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container); String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + log.info(data); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.Tomcat)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11JRE21ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11JRE21ContainerTest.java index a05a2e23..9454f4bc 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11JRE21ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11JRE21ContainerTest.java @@ -2,12 +2,14 @@ package com.reajason.javaweb.integration.probe.tomcat; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; -import com.reajason.javaweb.utils.CommonUtil; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; import net.bytebuddy.jar.asm.Opcodes; @@ -24,8 +26,6 @@ import java.util.List; import static com.reajason.javaweb.integration.ContainerTool.getUrl; import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile; import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk; -import static org.hamcrest.CoreMatchers.*; -import static org.hamcrest.MatcherAssert.assertThat; import static org.junit.jupiter.api.Assertions.assertEquals; /** @@ -83,20 +83,18 @@ public class Tomcat11JRE21ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V21, Packers.BigInteger, container); + MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container); String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); + log.info(data); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.Tomcat)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat5ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat5ContainerTest.java index c40240f9..7ffc4566 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat5ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat5ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.tomcat; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -26,7 +29,8 @@ import java.util.List; import static com.reajason.javaweb.integration.ContainerTool.getUrl; import static com.reajason.javaweb.integration.ContainerTool.warFile; import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk; -import static org.hamcrest.CoreMatchers.*; +import static org.hamcrest.CoreMatchers.anyOf; +import static org.hamcrest.CoreMatchers.startsWith; import static org.hamcrest.MatcherAssert.assertThat; import static org.junit.jupiter.api.Assertions.assertEquals; @@ -45,8 +49,8 @@ public class Tomcat5ContainerTest { .withExposedPorts(8080); @AfterAll - public static void stopContainer() { - System.out.println(container.getLogs()); + public static void tearDown() { + log.info(container.getLogs()); } // 存在首次请求，Tomcat 无法通过 req.getParameter 拿到参数的情况，因此需要重试 @@ -96,20 +100,17 @@ public class Tomcat5ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.Tomcat)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } \ No newline at end of file diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat6ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat6ContainerTest.java index 6d6b0d71..7395fa89 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat6ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat6ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.tomcat; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -88,20 +91,17 @@ public class Tomcat6ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.Tomcat)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } \ No newline at end of file diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat7ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat7ContainerTest.java index 6bba46c2..afcb5281 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat7ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat7ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.tomcat; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -90,20 +93,17 @@ public class Tomcat7ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.Tomcat)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } \ No newline at end of file diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat8ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat8ContainerTest.java index 769532ed..6aed73c6 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat8ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat8ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.tomcat; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -92,20 +95,17 @@ public class Tomcat8ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.Tomcat)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } \ No newline at end of file diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat9ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat9ContainerTest.java index 85073745..d7806d76 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat9ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat9ContainerTest.java @@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.tomcat; import com.reajason.javaweb.Server; import com.reajason.javaweb.integration.ProbeAssertion; +import com.reajason.javaweb.integration.ShellAssertion; import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.probe.DetectionTool; +import com.reajason.javaweb.memshell.MemShellResult; import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.packer.Packers; +import com.reajason.javaweb.probe.payload.FilterProbeFactory; import com.reajason.javaweb.utils.CommonUtil; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; @@ -82,20 +85,17 @@ public class Tomcat9ContainerTest { @Test void testFilterProbe() { String url = getUrl(container); - String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); - System.out.println(data); - assertThat(data, anyOf( - containsString("Context: ") - )); + String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat)); + ShellAssertion.assertFilterProbeIsRight(data); } @Test void testFilterFirstInject() { String url = getUrl(container); - shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); + MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe()); List filter = ProbeAssertion.getFiltersForContext(data, "/app"); String filterName = ProbeAssertion.extractFilterName(filter.get(0)); - assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.Tomcat)))); + assertEquals(filterName, memShellResult.getShellClassName()); } } diff --git a/vul/vul-webapp-expression/src/main/java/BigIntegerClassLaoderServlet.java b/vul/vul-webapp-expression/src/main/java/BigIntegerClassLoaderServlet.java similarity index 95% rename from vul/vul-webapp-expression/src/main/java/BigIntegerClassLaoderServlet.java rename to vul/vul-webapp-expression/src/main/java/BigIntegerClassLoaderServlet.java index ea9a59e0..a2e1be39 100644 --- a/vul/vul-webapp-expression/src/main/java/BigIntegerClassLaoderServlet.java +++ b/vul/vul-webapp-expression/src/main/java/BigIntegerClassLoaderServlet.java @@ -7,7 +7,7 @@ import java.io.IOException; * @since 2025/08/25 */ @WebServlet("/biginteger") -public class BigIntegerClassLaoderServlet extends ClassLoader implements Servlet { +public class BigIntegerClassLoaderServlet extends ClassLoader implements Servlet { @Override public void init(ServletConfig config) throws ServletException { diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/Base64ClassLoaderServlet.java b/vul/vul-webapp-jakarta/src/main/java/Base64ClassLoaderServlet.java similarity index 98% rename from vul/vul-webapp-jakarta/src/main/java/jakarta/Base64ClassLoaderServlet.java rename to vul/vul-webapp-jakarta/src/main/java/Base64ClassLoaderServlet.java index 465009a2..9d0faa1b 100644 --- a/vul/vul-webapp-jakarta/src/main/java/jakarta/Base64ClassLoaderServlet.java +++ b/vul/vul-webapp-jakarta/src/main/java/Base64ClassLoaderServlet.java @@ -1,5 +1,3 @@ -package jakarta; - import jakarta.servlet.*; import java.io.IOException; diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/BigIntegerClassLaoderServlet.java b/vul/vul-webapp-jakarta/src/main/java/BigIntegerClassLoaderServlet.java similarity index 82% rename from vul/vul-webapp-jakarta/src/main/java/jakarta/BigIntegerClassLaoderServlet.java rename to vul/vul-webapp-jakarta/src/main/java/BigIntegerClassLoaderServlet.java index c1e27bb3..21d2dafe 100644 --- a/vul/vul-webapp-jakarta/src/main/java/jakarta/BigIntegerClassLaoderServlet.java +++ b/vul/vul-webapp-jakarta/src/main/java/BigIntegerClassLoaderServlet.java @@ -1,5 +1,3 @@ -package jakarta; - import jakarta.servlet.*; import java.io.IOException; @@ -8,12 +6,12 @@ import java.io.IOException; * @author Wans * @since 2025/08/25 */ -public class BigIntegerClassLaoderServlet extends ClassLoader implements Servlet { +public class BigIntegerClassLoaderServlet extends ClassLoader implements Servlet { - public BigIntegerClassLaoderServlet() { + public BigIntegerClassLoaderServlet() { } - protected BigIntegerClassLaoderServlet(ClassLoader parent) { + protected BigIntegerClassLoaderServlet(ClassLoader parent) { super(parent); } @@ -32,7 +30,7 @@ public class BigIntegerClassLaoderServlet extends ClassLoader implements Servlet String data = req.getParameter("data"); try { byte[] bytes = decodeBigInteger(data); - new BigIntegerClassLaoderServlet(Thread.currentThread().getContextClassLoader()).defineClass(null, bytes, 0, bytes.length).newInstance(); + new BigIntegerClassLoaderServlet(Thread.currentThread().getContextClassLoader()).defineClass(null, bytes, 0, bytes.length).newInstance(); } catch (Exception e) { throw new RuntimeException(e); } diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/JavaReadObjServlet.java b/vul/vul-webapp-jakarta/src/main/java/JavaReadObjServlet.java similarity index 96% rename from vul/vul-webapp-jakarta/src/main/java/jakarta/JavaReadObjServlet.java rename to vul/vul-webapp-jakarta/src/main/java/JavaReadObjServlet.java index ae2c8969..3f7b4c87 100644 --- a/vul/vul-webapp-jakarta/src/main/java/jakarta/JavaReadObjServlet.java +++ b/vul/vul-webapp-jakarta/src/main/java/JavaReadObjServlet.java @@ -1,7 +1,4 @@ -package jakarta; - import jakarta.servlet.ServletException; -import jakarta.servlet.annotation.WebServlet; import jakarta.servlet.http.HttpServlet; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/ScriptEngineServlet.java b/vul/vul-webapp-jakarta/src/main/java/ScriptEngineServlet.java similarity index 97% rename from vul/vul-webapp-jakarta/src/main/java/jakarta/ScriptEngineServlet.java rename to vul/vul-webapp-jakarta/src/main/java/ScriptEngineServlet.java index 0f274523..8d13a5d7 100644 --- a/vul/vul-webapp-jakarta/src/main/java/jakarta/ScriptEngineServlet.java +++ b/vul/vul-webapp-jakarta/src/main/java/ScriptEngineServlet.java @@ -1,5 +1,3 @@ -package jakarta; - import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServlet; import jakarta.servlet.http.HttpServletRequest; diff --git a/vul/vul-webapp-jakarta/src/main/java/ServletNameTestFilter.java b/vul/vul-webapp-jakarta/src/main/java/ServletNameTestFilter.java new file mode 100644 index 00000000..a3088ef4 --- /dev/null +++ b/vul/vul-webapp-jakarta/src/main/java/ServletNameTestFilter.java @@ -0,0 +1,24 @@ +import jakarta.servlet.*; + +import java.io.IOException; + +/** + * @author ReaJason + * @since 2026/1/11 + */ +public class ServletNameTestFilter implements Filter { + @Override + public void init(FilterConfig filterConfig) throws ServletException { + + } + + @Override + public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { + chain.doFilter(request, response); + } + + @Override + public void destroy() { + + } +} diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/TestInputStreamServlet.java b/vul/vul-webapp-jakarta/src/main/java/TestInputStreamServlet.java similarity index 98% rename from vul/vul-webapp-jakarta/src/main/java/jakarta/TestInputStreamServlet.java rename to vul/vul-webapp-jakarta/src/main/java/TestInputStreamServlet.java index 5075ca2a..7df6fdf3 100644 --- a/vul/vul-webapp-jakarta/src/main/java/jakarta/TestInputStreamServlet.java +++ b/vul/vul-webapp-jakarta/src/main/java/TestInputStreamServlet.java @@ -1,5 +1,3 @@ -package jakarta; - import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServlet; import jakarta.servlet.http.HttpServletRequest; diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/TestReaderServlet.java b/vul/vul-webapp-jakarta/src/main/java/TestReaderServlet.java similarity index 98% rename from vul/vul-webapp-jakarta/src/main/java/jakarta/TestReaderServlet.java rename to vul/vul-webapp-jakarta/src/main/java/TestReaderServlet.java index e0c5702f..e7b6c6ad 100644 --- a/vul/vul-webapp-jakarta/src/main/java/jakarta/TestReaderServlet.java +++ b/vul/vul-webapp-jakarta/src/main/java/TestReaderServlet.java @@ -1,5 +1,3 @@ -package jakarta; - import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServlet; import jakarta.servlet.http.HttpServletRequest; diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/TestServlet.java b/vul/vul-webapp-jakarta/src/main/java/TestServlet.java similarity index 97% rename from vul/vul-webapp-jakarta/src/main/java/jakarta/TestServlet.java rename to vul/vul-webapp-jakarta/src/main/java/TestServlet.java index 2fbc84d5..e519622f 100644 --- a/vul/vul-webapp-jakarta/src/main/java/jakarta/TestServlet.java +++ b/vul/vul-webapp-jakarta/src/main/java/TestServlet.java @@ -1,5 +1,3 @@ -package jakarta; - import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServlet; import jakarta.servlet.http.HttpServletRequest; diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/UploadServlet.java b/vul/vul-webapp-jakarta/src/main/java/UploadServlet.java similarity index 96% rename from vul/vul-webapp-jakarta/src/main/java/jakarta/UploadServlet.java rename to vul/vul-webapp-jakarta/src/main/java/UploadServlet.java index 7e601360..b6b12b09 100644 --- a/vul/vul-webapp-jakarta/src/main/java/jakarta/UploadServlet.java +++ b/vul/vul-webapp-jakarta/src/main/java/UploadServlet.java @@ -1,8 +1,5 @@ -package jakarta; - import jakarta.servlet.ServletException; import jakarta.servlet.annotation.MultipartConfig; -import jakarta.servlet.annotation.WebServlet; import jakarta.servlet.http.HttpServlet; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/EmptyFilter.java b/vul/vul-webapp-jakarta/src/main/java/UrlMappingTestFilter.java similarity index 56% rename from vul/vul-webapp-jakarta/src/main/java/jakarta/EmptyFilter.java rename to vul/vul-webapp-jakarta/src/main/java/UrlMappingTestFilter.java index ba767e57..2284e9fa 100644 --- a/vul/vul-webapp-jakarta/src/main/java/jakarta/EmptyFilter.java +++ b/vul/vul-webapp-jakarta/src/main/java/UrlMappingTestFilter.java @@ -1,15 +1,22 @@ -package jakarta; - import jakarta.servlet.*; -import jakarta.servlet.annotation.WebFilter; import java.io.IOException; /** * @author ReaJason - * @since 2025/2/23 + * @since 2025/1/3 */ -public class EmptyFilter implements Filter { +public class UrlMappingTestFilter implements Filter { + @Override + public void destroy() { + + } + + @Override + public void init(FilterConfig filterConfig) throws ServletException { + + } + @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { chain.doFilter(request, response); diff --git a/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml b/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml index 88342ccc..3e608307 100644 --- a/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml +++ b/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml @@ -11,7 +11,7 @@ test - jakarta.TestServlet + TestServlet test @@ -20,7 +20,7 @@ upload - jakarta.UploadServlet + UploadServlet upload @@ -29,7 +29,7 @@ java-deserialize - jakarta.JavaReadObjServlet + JavaReadObjServlet java-deserialize @@ -38,7 +38,7 @@ b64 - jakarta.Base64ClassLoaderServlet + Base64ClassLoaderServlet b64 @@ -47,7 +47,7 @@ biginteger - jakarta.BigIntegerClassLaoderServlet + BigIntegerClassLoaderServlet biginteger @@ -56,7 +56,7 @@ js - jakarta.ScriptEngineServlet + ScriptEngineServlet js @@ -65,7 +65,7 @@ reader - jakarta.TestReaderServlet + TestReaderServlet reader @@ -74,7 +74,7 @@ inputStream - jakarta.TestInputStreamServlet + TestInputStreamServlet inputStream @@ -82,11 +82,27 @@ - empty - jakarta.EmptyFilter + urlMappingTestFilter + UrlMappingTestFilter + + + servletNameTestFilter + ServletNameTestFilter - empty - /* + urlMappingTestFilter + /b64 + + + urlMappingTestFilter + /test + + + servletNameTestFilter + b64 + + + servletNameTestFilter + biginteger \ No newline at end of file diff --git a/vul/vul-webapp/src/main/java/BigIntegerClassLaoderServlet.java b/vul/vul-webapp/src/main/java/BigIntegerClassLoaderServlet.java similarity index 83% rename from vul/vul-webapp/src/main/java/BigIntegerClassLaoderServlet.java rename to vul/vul-webapp/src/main/java/BigIntegerClassLoaderServlet.java index 20d12434..902b052b 100644 --- a/vul/vul-webapp/src/main/java/BigIntegerClassLaoderServlet.java +++ b/vul/vul-webapp/src/main/java/BigIntegerClassLoaderServlet.java @@ -5,12 +5,12 @@ import java.io.IOException; * @author Wans * @since 2025/08/25 */ -public class BigIntegerClassLaoderServlet extends ClassLoader implements Servlet { +public class BigIntegerClassLoaderServlet extends ClassLoader implements Servlet { - public BigIntegerClassLaoderServlet() { + public BigIntegerClassLoaderServlet() { } - protected BigIntegerClassLaoderServlet(ClassLoader parent) { + protected BigIntegerClassLoaderServlet(ClassLoader parent) { super(parent); } @@ -29,7 +29,7 @@ public class BigIntegerClassLaoderServlet extends ClassLoader implements Servlet String data = req.getParameter("data"); try { byte[] bytes = decodeBigInteger(data); - new BigIntegerClassLaoderServlet(Thread.currentThread().getContextClassLoader()).defineClass(null, bytes, 0, bytes.length).newInstance(); + new BigIntegerClassLoaderServlet(Thread.currentThread().getContextClassLoader()).defineClass(null, bytes, 0, bytes.length).newInstance(); } catch (Exception e) { throw new RuntimeException(e); } diff --git a/vul/vul-webapp/src/main/java/ServletNameTestFilter.java b/vul/vul-webapp/src/main/java/ServletNameTestFilter.java new file mode 100644 index 00000000..b8d9d799 --- /dev/null +++ b/vul/vul-webapp/src/main/java/ServletNameTestFilter.java @@ -0,0 +1,23 @@ +import javax.servlet.*; +import java.io.IOException; + +/** + * @author ReaJason + * @since 2026/1/11 + */ +public class ServletNameTestFilter implements Filter { + @Override + public void init(FilterConfig filterConfig) throws ServletException { + + } + + @Override + public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { + chain.doFilter(request, response); + } + + @Override + public void destroy() { + + } +} diff --git a/vul/vul-webapp/src/main/java/EmptyFilter.java b/vul/vul-webapp/src/main/java/UrlMappingTestFilter.java similarity index 89% rename from vul/vul-webapp/src/main/java/EmptyFilter.java rename to vul/vul-webapp/src/main/java/UrlMappingTestFilter.java index ffa67d23..dd567106 100644 --- a/vul/vul-webapp/src/main/java/EmptyFilter.java +++ b/vul/vul-webapp/src/main/java/UrlMappingTestFilter.java @@ -5,7 +5,7 @@ import java.io.IOException; * @author ReaJason * @since 2025/1/3 */ -public class EmptyFilter implements Filter { +public class UrlMappingTestFilter implements Filter { @Override public void destroy() { diff --git a/vul/vul-webapp/src/main/webapp/WEB-INF/web.xml b/vul/vul-webapp/src/main/webapp/WEB-INF/web.xml index 10cb2981..4ba9f2c6 100644 --- a/vul/vul-webapp/src/main/webapp/WEB-INF/web.xml +++ b/vul/vul-webapp/src/main/webapp/WEB-INF/web.xml @@ -53,7 +53,7 @@ biginteger - BigIntegerClassLaoderServlet + BigIntegerClassLoaderServlet biginteger @@ -79,11 +79,27 @@ - godzilla - EmptyFilter + urlMappingTestFilter + UrlMappingTestFilter + + + servletNameTestFilter + ServletNameTestFilter - godzilla - /* + urlMappingTestFilter + /b64 + + + urlMappingTestFilter + /test + + + servletNameTestFilter + b64 + + + servletNameTestFilter + biginteger \ No newline at end of file