archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-21 22:50:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support servletNameFilter for GlassFishFilterProbe

Browse Source
This commit is contained in:
ReaJason
2026-01-12 02:12:34 +08:00
parent 4f080df85a
commit e44caeba1b
37 changed files with 171 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration-test/src/test/java/com/reajason/javaweb/integration/probe/DetectionTool.java
-12
View File
@@ -35,14 +35,6 @@ public class DetectionTool {
return getBase64Class(ServerProbe.class);
}
public static String getTomcatFilterProbe() {
return getBase64Class(TomcatFilterProbe.class);
}
public static String getJettyFilterProbe() {
return getBase64Class(JettyFilterProbe.class);
}
public static String getResinFilterProbe() {
return getBase64Class(ResinFilterProbe.class);
}
@@ -51,10 +43,6 @@ public class DetectionTool {
return getBase64Class(UndertowFilterProbe.class);
}
public static String getGlassFishFilterProbe() {
return getBase64Class(GlassFishFilterProbe.class);
}
public static String getApusicFilterProbe() {
return getBase64Class(ApusicFilterProbe.class);
}
integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish3ContainerTest.java
+8 -8
View File
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.glassfish;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import com.reajason.javaweb.utils.CommonUtil;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
@@ -94,20 +97,17 @@ public class GlassFish3ContainerTest {
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
System.out.println(data);
assertThat(data, anyOf(
containsString("EmptyFilter")
));
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish))));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish4ContainerTest.java
+8 -8
View File
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.glassfish;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import com.reajason.javaweb.utils.CommonUtil;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
@@ -94,20 +97,17 @@ public class GlassFish4ContainerTest {
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
System.out.println(data);
assertThat(data, anyOf(
containsString("EmptyFilter")
));
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish))));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish501ContainerTest.java
+8 -8
View File
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.glassfish;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import com.reajason.javaweb.utils.CommonUtil;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
@@ -87,20 +90,17 @@ public class GlassFish501ContainerTest {
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
System.out.println(data);
assertThat(data, anyOf(
containsString("EmptyFilter")
));
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish))));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish510ContainerTest.java
+8 -8
View File
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.glassfish;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import com.reajason.javaweb.utils.CommonUtil;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
@@ -88,20 +91,17 @@ public class GlassFish510ContainerTest {
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
System.out.println(data);
assertThat(data, anyOf(
containsString("EmptyFilter")
));
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish))));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish6ContainerTest.java
+8 -8
View File
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.glassfish;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import com.reajason.javaweb.utils.CommonUtil;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
@@ -88,20 +91,17 @@ public class GlassFish6ContainerTest {
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
System.out.println(data);
assertThat(data, anyOf(
containsString("EmptyFilter")
));
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish))));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
integration-test/src/test/java/com/reajason/javaweb/integration/probe/glassfish/GlassFish7ContainerTest.java
+8 -8
View File
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.glassfish;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import com.reajason.javaweb.utils.CommonUtil;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
@@ -94,20 +97,17 @@ public class GlassFish7ContainerTest {
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
System.out.println(data);
assertThat(data, anyOf(
containsString("EmptyFilter")
));
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish))));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss423ContainerTest.java
+1 -1
View File
@@ -94,7 +94,7 @@ public class Jboss423ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss510ContainerTest.java
+1 -1
View File
@@ -92,7 +92,7 @@ public class Jboss510ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss610ContainerTest.java
+1 -1
View File
@@ -92,7 +92,7 @@ public class Jboss610ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jbossas/Jboss711ContainerTest.java
+1 -1
View File
@@ -92,7 +92,7 @@ public class Jboss711ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty10ContainerTest.java
+1 -1
View File
@@ -97,7 +97,7 @@ public class Jetty10ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V11, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty11ContainerTest.java
+1 -1
View File
@@ -98,7 +98,7 @@ public class Jetty11ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee10ContainerTest.java
+1 -1
View File
@@ -83,7 +83,7 @@ public class Jetty12ee10ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.Jetty, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("org.eclipse.jetty.servlet.handlers")));
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee11ContainerTest.java
+1 -1
View File
@@ -83,7 +83,7 @@ public class Jetty12ee11ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.Jetty, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("org.eclipse.jetty.servlet.handlers")));
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee8ContainerTest.java
+1 -1
View File
@@ -90,7 +90,7 @@ public class Jetty12ee8ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty12ee9ContainerTest.java
+1 -1
View File
@@ -83,7 +83,7 @@ public class Jetty12ee9ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.Jetty, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("org.eclipse.jetty.servlet.handlers")));
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty61ContainerTest.java
+1 -1
View File
@@ -95,7 +95,7 @@ public class Jetty61ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty75ContainerTest.java
+1 -1
View File
@@ -89,7 +89,7 @@ public class Jetty75ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty76ContainerTest.java
+1 -1
View File
@@ -91,7 +91,7 @@ public class Jetty76ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty81ContainerTest.java
+1 -1
View File
@@ -91,7 +91,7 @@ public class Jetty81ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty92ContainerTest.java
+1 -1
View File
@@ -92,7 +92,7 @@ public class Jetty92ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty93ContainerTest.java
+1 -1
View File
@@ -91,7 +91,7 @@ public class Jetty93ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/jetty/Jetty94ContainerTest.java
+1 -1
View File
@@ -91,7 +91,7 @@ public class Jetty94ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Jetty, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getJettyFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Jetty));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara5201ContainerTest.java
+8 -8
View File
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.payara;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import com.reajason.javaweb.utils.CommonUtil;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
@@ -93,20 +96,17 @@ public class Payara5201ContainerTest {
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
System.out.println(data);
assertThat(data, anyOf(
containsString("Context: ")
));
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish))));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara520225ContainerTest.java
+8 -8
View File
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.payara;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import com.reajason.javaweb.utils.CommonUtil;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
@@ -87,20 +90,17 @@ public class Payara520225ContainerTest {
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
System.out.println(data);
assertThat(data, anyOf(
containsString("Context: ")
));
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish))));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
integration-test/src/test/java/com/reajason/javaweb/integration/probe/payara/Payara620222ContainerTest.java
+8 -8
View File
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.payara;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import com.reajason.javaweb.utils.CommonUtil;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
@@ -88,20 +91,17 @@ public class Payara620222ContainerTest {
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
System.out.println(data);
assertThat(data, anyOf(
containsString("Context: ")
));
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getGlassFishFilterProbe());
MemShellResult memShellResult = shellInjectIsOk(url, Server.GlassFish, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.GlassFish));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.GlassFish))));
assertEquals(filterName, memShellResult.getShellClassName());
}
}
integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat10ContainerTest.java
+1 -1
View File
@@ -103,7 +103,7 @@ public class Tomcat10ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V11, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
log.info(data);
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11ContainerTest.java
+1 -1
View File
@@ -93,7 +93,7 @@ public class Tomcat11ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
log.info(data);
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat11JRE21ContainerTest.java
+1 -1
View File
@@ -91,7 +91,7 @@ public class Tomcat11JRE21ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V21, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
log.info(data);
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat5ContainerTest.java
+1 -1
View File
@@ -108,7 +108,7 @@ public class Tomcat5ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat6ContainerTest.java
+1 -1
View File
@@ -99,7 +99,7 @@ public class Tomcat6ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat7ContainerTest.java
+1 -1
View File
@@ -101,7 +101,7 @@ public class Tomcat7ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat8ContainerTest.java
+1 -1
View File
@@ -103,7 +103,7 @@ public class Tomcat8ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat9ContainerTest.java
+1 -1
View File
@@ -93,7 +93,7 @@ public class Tomcat9ContainerTest {
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.Tomcat, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getTomcatFilterProbe());
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());