test: support bypass CSRF

integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertion.java

@@ -174,7 +174,7 @@ public class ShellAssertion {
     private static void neoreGeorgIsOk(GenericContainer<?> container, GenericContainer<?> pythonContainer, String shellUrl, NeoreGeorgConfig shellToolConfig) throws Exception {
         URL url = new URL(shellUrl);
         shellUrl = "http://app:" + container.getExposedPorts().stream().findFirst().get() + url.getPath();
-        String stdout = pythonContainer.execInContainer("python", "/app/neoreg.py", "-k", "key", "-H", shellToolConfig.getHeaderName() + ": " + shellToolConfig.getHeaderValue(), "-u", shellUrl).getStdout();
+        String stdout = pythonContainer.execInContainer("python", "/app/neoreg.py", "-k", "key", "-H", shellToolConfig.getHeaderName() + ": " + shellUrl + "?" + shellToolConfig.getHeaderValue(), "-u", shellUrl).getStdout();
         log.info(stdout);
         assertTrue(stdout.contains("All seems fine"));
     }
@@ -231,8 +231,8 @@ public class ShellAssertion {
         AntSwordManager antSwordManager = AntSwordManager.builder()
                 .entrypoint(entrypoint)
                 .pass(shellConfig.getPass())
-                .header(shellConfig.getHeaderName()
+                .header(shellConfig.getHeaderName(), shellConfig.getHeaderValue())
-                        , shellConfig.getHeaderValue()).build();
+                .build();
         assertTrue(antSwordManager.getInfo().contains("ok"));
     }
 

integration-test/src/test/java/com/reajason/javaweb/integration/VulTool.java

@@ -37,6 +37,7 @@ public class VulTool {
                 .build();
         Request request = new Request.Builder()
                 .url(uploadUrl).post(requestBody)
+                .header("Referer", uploadUrl)
                 .build();
         try (Response response = new OkHttpClient().newCall(request).execute()) {
             System.out.println(response.body().string());
@@ -51,6 +52,7 @@ public class VulTool {
                 .build();
         Request request = new Request.Builder()
                 .header("Content-Type", "application/x-www-form-urlencoded")
+                .header("Referer", uploadUrl)
                 .url(uploadUrl).post(requestBody)
                 .build();
         try (Response response = new OkHttpClient().newCall(request).execute()) {
@@ -66,6 +68,7 @@ public class VulTool {
                 .build();
         Request request = new Request.Builder()
                 .header("Content-Type", "application/x-www-form-urlencoded")
+                .header("Referer", uploadUrl)
                 .url(uploadUrl).post(requestBody)
                 .build();
         try (Response response = new OkHttpClient().newCall(request).execute()) {

tools/ant-sword/src/main/java/com/reajason/javaweb/antsword/AntSwordManager.java

@@ -80,6 +80,7 @@ public class AntSwordManager {
             manager.setEntrypoint(entrypoint);
             Map<String, String> headers = new HashMap<>(16);
             headers.put("Content-Type", "application/x-www-form-urlencoded");
+            headers.put("Referer", entrypoint);
             headers.putAll(this.headers);
             manager.setHeaders(headers);
             return manager;

tools/behinder/src/main/java/com/reajason/javaweb/behinder/BehinderManager.java

@@ -171,6 +171,7 @@ public class BehinderManager {
             headers.put("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0");
             headers.put("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");
             headers.put("Accept-Language", "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2");
+            headers.put("Referer", entrypoint);
             headers.putAll(this.headers);
             manager.setHeaders(headers);
             return manager;

tools/godzilla/src/main/java/com/reajason/javaweb/godzilla/GodzillaManager.java

@@ -303,6 +303,7 @@ public class GodzillaManager implements Closeable {
             headers.put("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0");
             headers.put("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");
             headers.put("Accept-Language", "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2");
+            headers.put("Referer", entrypoint);
             headers.putAll(this.headers);
             manager.setHeaders(headers);
             if (entrypoint.startsWith("http")) {