Skip to content

Commit a37c6a7

Browse files
whgojpwhgojp
committed
V1.4
1 parent 78ff85c commit a37c6a7

107 files changed

Lines changed: 3939 additions & 357 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,4 +36,5 @@ build/
3636

3737
/logs/
3838
/.idea/
39-
/src/test/
39+
/src/test/
40+
src/main/resources/application-aliyun.yml

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ FROM openjdk:8
33
WORKDIR /work
44

55
LABEL maintainer="whgojp@foxmail.com"
6-
LABEL version="1.3"
6+
LABEL version="1.4"
77
LABEL description="I think therefore I am."
88

99
COPY target/JavaSecLab.jar /work/JavaSecLab.jar

‎pom.xml‎

Lines changed: 38 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,14 @@
88
<artifactId>JavaSecLab</artifactId>
99
<version>1.3.0</version>
1010
<name>Java综合漏洞平台</name>
11-
<description>hello JavaSec!</description>
11+
<description>hello JavaSecLab!</description>
1212
<parent>
1313
<groupId>org.springframework.boot</groupId>
1414
<artifactId>spring-boot-starter-parent</artifactId>
1515
<!-- springboot 高版本不存在thymeleaf模板注入漏洞-->
16-
<!-- <version>2.7.14</version>-->
17-
<version>2.4.1</version>
18-
<!-- <version>2.5.6</version>-->
16+
<!-- <version>2.7.14</version>-->
17+
<version>2.4.1</version>
18+
<!-- <version>2.5.6</version>-->
1919
<relativePath/>
2020
</parent>
2121
<properties>
@@ -26,9 +26,10 @@
2626
<hutool.version>5.8.21</hutool.version>
2727
<lombok.version>1.18.4</lombok.version>
2828
<mybatis-plus.version>3.5.1</mybatis-plus.version>
29-
<mysql.version>8.0.33</mysql.version>
29+
<!-- <mysql.version>8.0.33</mysql.version>-->
30+
<mysql.version>8.0.14</mysql.version>
3031
<esapi.version>2.2.0.0</esapi.version>
31-
<jwt.version>0.10.7</jwt.version>
32+
<jwt.version>0.11.5</jwt.version>
3233
</properties>
3334
<dependencies>
3435
<!-- Spring Boot Starters -->
@@ -106,12 +107,18 @@
106107
<!-- </dependency>-->
107108

108109
<!-- 数据库 -->
110+
<!-- <dependency>-->
111+
<!-- <groupId>com.mysql</groupId>-->
112+
<!-- <artifactId>mysql-connector-j</artifactId>-->
113+
<!-- <version>${mysql.version}</version>-->
114+
<!-- </dependency>-->
109115
<dependency>
110-
<groupId>com.mysql</groupId>
111-
<artifactId>mysql-connector-j</artifactId>
112-
<version>${mysql.version}</version>
116+
<groupId>mysql</groupId>
117+
<artifactId>mysql-connector-java</artifactId>
118+
<version>8.0.14</version> <!-- 可尝试 8.0.19 或更高版本 -->
113119
</dependency>
114120

121+
115122
<!-- MyBatis Plus -->
116123
<dependency>
117124
<groupId>com.baomidou</groupId>
@@ -271,7 +278,23 @@
271278
<version>1.70</version>
272279
</dependency>
273280

281+
<dependency>
282+
<groupId>ognl</groupId>
283+
<artifactId>ognl</artifactId>
284+
<version>3.3.1</version>
285+
</dependency>
274286

287+
<dependency>
288+
<groupId>commons-collections</groupId>
289+
<artifactId>commons-collections</artifactId>
290+
<version>3.2.1</version>
291+
</dependency>
292+
293+
<dependency>
294+
<groupId>org.springframework.boot</groupId>
295+
<artifactId>spring-boot-starter-websocket</artifactId>
296+
<version>2.4.1</version>
297+
</dependency>
275298

276299
</dependencies>
277300
<build>
@@ -296,29 +319,16 @@
296319
</plugin>
297320
</plugins>
298321
</build>
322+
299323
<repositories>
300324
<repository>
301-
<id>central</id>
302-
<url>https://repo.maven.apache.org/maven2</url>
303-
</repository>
304-
<repository>
305-
<id>spring-milestone</id>
306-
<url>https://repo.spring.io/milestone</url>
307-
</repository>
308-
<repository>
309-
<id>spring-release</id>
310-
<url>https://repo.spring.io/release</url>
325+
<id>aliyun-central</id>
326+
<url>https://maven.aliyun.com/repository/central</url>
311327
</repository>
312328
<repository>
313-
<id>acfunnexus</id>
314-
<url>https://maven.aliyun.com/repository/public/</url>
315-
<layout>default</layout>
316-
<releases>
317-
<enabled>true</enabled>
318-
</releases>
319-
<snapshots>
320-
<enabled>true</enabled>
321-
</snapshots>
329+
<id>aliyun-public</id>
330+
<url>https://maven.aliyun.com/repository/public</url>
322331
</repository>
323332
</repositories>
333+
324334
</project>

‎sql/JavaSecLab.sql‎

Lines changed: 33 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Navicat Premium Data Transfer
2+
Navicat Premium Dump SQL
33
44
Source Server : mysql_docker_mac
55
Source Server Type : MySQL
@@ -11,10 +11,8 @@
1111
Target Server Version : 80200 (8.2.0)
1212
File Encoding : 65001
1313
14-
Date: 10/11/2024 13:17:18
14+
Date: 21/03/2025 16:51:30
1515
*/
16-
CREATE DATABASE IF NOT EXISTS JavaSecLab;
17-
USE JavaSecLab;
1816

1917
SET NAMES utf8mb4;
2018
SET FOREIGN_KEY_CHECKS = 0;
@@ -25,8 +23,8 @@ SET FOREIGN_KEY_CHECKS = 0;
2523
DROP TABLE IF EXISTS `hsqli`;
2624
CREATE TABLE `hsqli` (
2725
`id` bigint NOT NULL AUTO_INCREMENT,
28-
`password` varchar(255) COLLATE utf8mb4_general_ci DEFAULT NULL,
29-
`username` varchar(255) COLLATE utf8mb4_general_ci DEFAULT NULL,
26+
`password` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci DEFAULT NULL,
27+
`username` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci DEFAULT NULL,
3028
PRIMARY KEY (`id`)
3129
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
3230

@@ -41,11 +39,11 @@ COMMIT;
4139
-- ----------------------------
4240
DROP TABLE IF EXISTS `log`;
4341
CREATE TABLE `log` (
44-
`logId` varchar(255) COLLATE utf8mb4_general_ci NOT NULL COMMENT 'log_id',
45-
`username` varchar(255) COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT '用户名',
46-
`optionName` varchar(255) COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT '用户操作',
47-
`optionTerminal` varchar(255) COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT '操作终端',
48-
`optionIp` varchar(255) COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT 'Ip地址',
42+
`logId` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT 'log_id',
43+
`username` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT '用户名',
44+
`optionName` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT '用户操作',
45+
`optionTerminal` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT '操作终端',
46+
`optionIp` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT 'Ip地址',
4947
`optionTime` date DEFAULT NULL COMMENT '创建时间',
5048
PRIMARY KEY (`logId`)
5149
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
@@ -56,14 +54,31 @@ CREATE TABLE `log` (
5654
BEGIN;
5755
COMMIT;
5856

57+
-- ----------------------------
58+
-- Table structure for objects
59+
-- ----------------------------
60+
DROP TABLE IF EXISTS `objects`;
61+
CREATE TABLE `objects` (
62+
`id` int NOT NULL,
63+
`malicious_object` blob,
64+
PRIMARY KEY (`id`)
65+
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
66+
67+
-- ----------------------------
68+
-- Records of objects
69+
-- ----------------------------
70+
BEGIN;
71+
INSERT INTO `objects` (`id`, `malicious_object`) VALUES (1, 0xACED000573720034746F702E7768676F6A702E6D6F64756C65732E737072696E67626F6F742E656E746974792E4D616C6963696F75734F626A656374C007A841C29C41060200014C0007636F6D6D616E647400124C6A6176612F6C616E672F537472696E673B78707400126F70656E202D612043616C63756C61746F72);
72+
COMMIT;
73+
5974
-- ----------------------------
6075
-- Table structure for sqli
6176
-- ----------------------------
6277
DROP TABLE IF EXISTS `sqli`;
6378
CREATE TABLE `sqli` (
6479
`id` int NOT NULL AUTO_INCREMENT,
65-
`username` varchar(255) COLLATE utf8mb4_general_ci NOT NULL COMMENT '用户名',
66-
`password` varchar(255) COLLATE utf8mb4_general_ci NOT NULL COMMENT '密码',
80+
`username` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT '用户名',
81+
`password` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT '密码',
6782
PRIMARY KEY (`id`) USING BTREE
6883
) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
6984

@@ -79,8 +94,8 @@ COMMIT;
7994
-- ----------------------------
8095
DROP TABLE IF EXISTS `user`;
8196
CREATE TABLE `user` (
82-
`username` varchar(255) COLLATE utf8mb4_general_ci NOT NULL COMMENT '用户名',
83-
`password` varchar(255) COLLATE utf8mb4_general_ci NOT NULL COMMENT '密码',
97+
`username` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT '用户名',
98+
`password` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT '密码',
8499
PRIMARY KEY (`username`)
85100
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
86101

@@ -99,11 +114,11 @@ COMMIT;
99114
DROP TABLE IF EXISTS `xss`;
100115
CREATE TABLE `xss` (
101116
`id` int NOT NULL AUTO_INCREMENT COMMENT '主键id',
102-
`content` text COLLATE utf8mb4_general_ci NOT NULL COMMENT '插入内容',
117+
`content` text CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT '插入内容',
103118
`ua` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT 'User-Agent',
104-
`date` varchar(255) COLLATE utf8mb4_general_ci NOT NULL COMMENT '插入时间',
119+
`date` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL COMMENT '插入时间',
105120
PRIMARY KEY (`id`)
106-
) ENGINE=InnoDB AUTO_INCREMENT=82 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
121+
) ENGINE=InnoDB AUTO_INCREMENT=84 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
107122

108123
-- ----------------------------
109124
-- Records of xss

‎src/main/java/top/whgojp/common/utils/CheckUserInput.java‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
package top.whgojp.common.utils;
22

33
import org.springframework.stereotype.Component;
4-
4+
import org.springframework.web.util.HtmlUtils;
55
import java.net.URI;
66
import java.net.URISyntaxException;
77
import java.util.ArrayList;
88
import java.util.Arrays;
99
import java.util.List;
10+
import java.util.regex.Pattern;
1011

1112
/**
1213
* @description 用户输入数据校验
@@ -16,6 +17,30 @@
1617
*/
1718
@Component
1819
public class CheckUserInput {
20+
private static final Pattern SCRIPT_PATTERN = Pattern.compile("<script[^>]*>.*?</script>", Pattern.CASE_INSENSITIVE | Pattern.DOTALL);
21+
private static final Pattern EVENT_PATTERN = Pattern.compile("on\\w+\\s*=", Pattern.CASE_INSENSITIVE);
22+
private static final Pattern JAVASCRIPT_PATTERN = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);
23+
24+
public String filter(String input) {
25+
if (input == null) {
26+
return "";
27+
}
28+
29+
// 基本HTML转义
30+
String filtered = HtmlUtils.htmlEscape(input);
31+
32+
// 移除script标签
33+
filtered = SCRIPT_PATTERN.matcher(filtered).replaceAll("");
34+
35+
// 移除事件处理器
36+
filtered = EVENT_PATTERN.matcher(filtered).replaceAll("");
37+
38+
// 移除javascript:协议
39+
filtered = JAVASCRIPT_PATTERN.matcher(filtered).replaceAll("");
40+
41+
return filtered;
42+
}
43+
1944
public String checkUser(String username, String password, Integer id) {
2045
String message = "";
2146
if (username == null || username.isEmpty()) {

‎src/main/java/top/whgojp/modules/components/fastjson/controller/FastjsonController.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,11 @@ public String vul(@RequestBody String content) {
3838
}
3939
}
4040

41+
public String vul2(){
42+
43+
return "";
44+
}
45+
4146
@PostMapping("/safe")
4247
@ResponseBody
4348
public String safe(@RequestBody String content) {

‎src/main/java/top/whgojp/modules/deserialize/readobject/controller/ReadObjectController.java‎

Lines changed: 31 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@
88
import org.springframework.web.bind.annotation.*;
99
import top.whgojp.common.utils.R;
1010
import top.whgojp.modules.sqli.entity.Sqli;
11+
import java.io.ByteArrayInputStream;
12+
import java.io.ObjectInputStream;
13+
1114

1215
import java.io.ByteArrayInputStream;
1316
import java.util.Base64;
@@ -30,23 +33,46 @@ public String readObject(){
3033
return "vul/deserialize/readObject";
3134
}
3235

36+
// @RequestMapping("/vul")
37+
// @ResponseBody
38+
// public R vul(String payload) {
39+
// System.setProperty("org.apache.commons.collections.enableUnsafeSerialization", "true");
40+
// log.info("Java反序列化："+payload);
41+
// try {
42+
// payload = payload.replace(" ", "+");
43+
// byte[] bytes = Base64.getDecoder().decode(payload);
44+
// ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
45+
// java.io.ObjectInputStream in = new java.io.ObjectInputStream(stream);
46+
// in.readObject();
47+
// in.close();
48+
// return R.ok("[+]Java反序列化：ObjectInputStream.readObject()");
49+
// } catch (Exception e) {
50+
// return R.error("[-]请输入正确的Payload！\n"+e.getMessage());
51+
// }
52+
// }
3353
@RequestMapping("/vul")
3454
@ResponseBody
3555
public R vul(String payload) {
3656
System.setProperty("org.apache.commons.collections.enableUnsafeSerialization", "true");
37-
log.info("Java反序列化："+payload);
57+
log.info("Java反序列化：" + payload);
3858
try {
3959
payload = payload.replace(" ", "+");
4060
byte[] bytes = Base64.getDecoder().decode(payload);
4161
ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
42-
java.io.ObjectInputStream in = new java.io.ObjectInputStream(stream);
43-
in.readObject();
62+
ObjectInputStream in = new ObjectInputStream(stream);
63+
64+
Object obj = in.readObject();
65+
log.info("反序列化对象：" + obj.toString());
66+
4467
in.close();
45-
return R.ok("[+]Java反序列化：ObjectInputStream.readObject()");
68+
return R.ok("[+]Java反序列化："+obj);
4669
} catch (Exception e) {
47-
return R.error("[-]请输入正确的Payload！\n"+e.getMessage());
70+
return R.error("[-] 请输入正确的 Payload！\n" + e.getMessage());
4871
}
4972
}
73+
74+
75+
5076
@RequestMapping("/safe1")
5177
@ResponseBody
5278
public R safe1(String payload) {

‎src/main/java/top/whgojp/modules/deserialize/snakeyaml/controller/controller/SnakeYamlController.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ public String snakeYaml(){
3232
@RequestMapping("/vul")
3333
@ResponseBody
3434
public R vul(String payload) {
35+
log.info("payload："+payload);
3536
Yaml y = new Yaml();
3637
y.load(payload);
3738
return R.ok("[+]Java反序列化：SnakeYaml原生漏洞");

‎src/main/java/top/whgojp/modules/funny/controller/HijackController.java‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
package top.whgojp.modules.funny.controller;
2+
3+
import io.swagger.annotations.Api;
4+
import lombok.extern.slf4j.Slf4j;
5+
import org.springframework.stereotype.Controller;
6+
import org.springframework.web.bind.annotation.CrossOrigin;
7+
import org.springframework.web.bind.annotation.RequestMapping;
8+
9+
/**
10+
* @description <功能描述>
11+
* @author: whgojp
12+
* @email: whgojp@foxmail.com
13+
* @Date: 2025/1/17 16:31
14+
*/
15+
@Slf4j
16+
@Api(value = "HijackController", tags = "劫持模块")
17+
@Controller
18+
@CrossOrigin(origins = "*")
19+
@RequestMapping("/funny/hijack")
20+
public class HijackController {
21+
@RequestMapping()
22+
public String hijack(){
23+
return "/vul/funny/hijack";
24+
}
25+
26+
}

0 commit comments

Comments
 (0)