Skip to content

Commit 435deb9

Browse files
bewhalebewhale
committed
update
1 parent a7edccf commit 435deb9

File tree

216 files changed

+41870
-133
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

216 files changed

+41870
-133
lines changed

‎src/main/java/org/bewhale/javasec/controller/AdminController.java‎

Lines changed: 102 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,121 @@
11
package org.bewhale.javasec.controller;
22

3+
import com.wf.captcha.utils.CaptchaUtil;
34
import org.bewhale.javasec.model.Admin;
45
import org.bewhale.javasec.service.AdminService;
56
import org.springframework.beans.factory.annotation.Autowired;
67
import org.springframework.stereotype.Controller;
8+
import org.springframework.ui.Model;
79
import org.springframework.web.bind.annotation.*;
810

9-
@RequestMapping("/admin")
11+
import javax.servlet.http.HttpServletRequest;
12+
import javax.servlet.http.HttpServletResponse;
13+
import javax.servlet.http.HttpSession;
14+
import java.text.SimpleDateFormat;
15+
import java.util.Date;
16+
import java.util.Map;
17+
1018
@Controller
1119
public class AdminController {
12-
@GetMapping("")
13-
public String index() {
14-
return "admin/adminlogin";
15-
}
16-
1720
@Autowired
1821
@SuppressWarnings("all")
1922
AdminService adminService;
2023

24+
@RequestMapping({"/", "/index", "/login", "/admin"})
25+
public String index(HttpSession session) {
26+
if (session.getAttribute("username") != null) {
27+
return "redirect:/home";
28+
}
29+
return "redirect:/admin/login";
30+
}
31+
32+
@GetMapping("/home")
33+
public String home(HttpSession session, Model model) {
34+
model.addAttribute("results", session.getAttribute("username"));
35+
return "/admin/home";
36+
}
37+
38+
@GetMapping("/admin/logout")
2139
@ResponseBody
22-
@PostMapping("/login")
23-
public String login(@RequestParam(name="username", required =true) String username,
24-
@RequestParam(name="password", required = true) String password){
40+
public String logout(HttpSession session) {
41+
session.invalidate();
42+
return "注销成功，请重新登录！";
43+
}
44+
45+
@RequestMapping("/admin/login")
46+
public String login(String username, String password,
47+
// @RequestParam(name = "password", required = true) String password,
48+
String captcha, String path,
49+
HttpSession session, HttpServletRequest request, Model model) {
2550

26-
Admin admin = adminService.login(username, password);//调用service层抽象类方法,返回一个承接了数据库返回值的实体类
27-
if (admin != null) {//很简单的逻辑,返回的只要不是空值就说明是存在的,ok
28-
return "welcome adminster!" + admin;//返回一段文本
51+
if (request.getMethod().equals("GET"))
52+
return "login";
53+
54+
if (!CaptchaUtil.ver(captcha, request)) {
55+
CaptchaUtil.clear(request);
56+
model.addAttribute("msg", "验证码不正确");
57+
return "login";
58+
}
59+
Admin admin = adminService.login(username, password);
60+
if (admin != null) {
61+
session.setAttribute("username", username);
62+
if (path != null) {
63+
return "redirect:" + path;
64+
}
65+
return "redirect:/home";
66+
} else {
67+
model.addAttribute("msg", "用户名或密码错误");
68+
return "login";
2969
}
30-
return "/err";//返回到另一个界面,但是目前还没做
70+
}
71+
72+
@GetMapping("/captcha")
73+
public void captcha(HttpServletRequest request, HttpServletResponse response) throws Exception {
74+
CaptchaUtil.out(request, response);
75+
}
76+
77+
@GetMapping("/admin/password")
78+
public String chPwdView() {
79+
return "/admin/password";
80+
}
81+
82+
@PostMapping("/admin/chpwd")
83+
@ResponseBody
84+
public String changePassword(@RequestBody Map<String, String> map, HttpSession session) {
85+
String old_password = map.get("old_password");
86+
String new_password = map.get("new_password");
87+
String again_password = map.get("again_password");
88+
String username = (String) session.getAttribute("username");
89+
if (old_password == null || new_password == null || again_password == null) {
90+
return "输入不能为空!";
91+
}
92+
if (old_password.equals(new_password)) {
93+
return "新密码不能与旧密码一致!";
94+
}
95+
if (!new_password.equals(again_password)) {
96+
return "新密码两次输入不一致!";
97+
}
98+
Admin admin = adminService.login(username, old_password);
99+
if (admin != null) {
100+
if (adminService.updatePWD(username, new_password) != 0) {
101+
session.invalidate();
102+
return "密码修改成功!";
103+
} else {
104+
return "密码修改失败!";
105+
}
106+
} else {
107+
return "旧密码输入错误!";
108+
}
109+
}
110+
111+
@RequestMapping("/admin/index")
112+
public String adminIndex(Model model , HttpSession session) {
113+
Date day=new Date();
114+
SimpleDateFormat df = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
115+
model.addAttribute("date", df.format(day));
116+
model.addAttribute("username", session.getAttribute("username"));
117+
model.addAttribute("os", System.getProperty("os.name"));
118+
model.addAttribute("java", System.getProperty("java.version"));
119+
return "admin/index";
31120
}
32121
}

‎src/main/java/org/bewhale/javasec/controller/basevul/CORSVul.java‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
package org.bewhale.javasec.controller.basevul;
2+
3+
import org.bewhale.javasec.model.Admin;
4+
import org.bewhale.javasec.service.AdminService;
5+
import org.springframework.beans.factory.annotation.Autowired;
6+
import org.springframework.web.bind.annotation.GetMapping;
7+
import org.springframework.web.bind.annotation.RequestMapping;
8+
import org.springframework.web.bind.annotation.RestController;
9+
import javax.servlet.http.HttpServletRequest;
10+
import javax.servlet.http.HttpServletResponse;
11+
import javax.servlet.http.HttpSession;
12+
13+
@RestController
14+
@RequestMapping("/home/cors")
15+
public class CORSVul {
16+
17+
@Autowired
18+
@SuppressWarnings("all")
19+
AdminService adminService;
20+
21+
@GetMapping("")
22+
public String corsVul(HttpServletRequest request, HttpServletResponse response, HttpSession httpSession) {
23+
// origin头可控
24+
String origin = request.getHeader("origin");
25+
response.setHeader("Access-Control-Allow-Origin", origin);
26+
response.setHeader("Access-Control-Allow-Credentials", "true");
27+
response.setHeader("Access-Control-Allow-Methods", "GET,POST,PUT,DELETE,OPTIONS");
28+
String username = (String) httpSession.getAttribute("username");
29+
Admin admin = adminService.getInfoByUserName(username);
30+
return "登录用户名: " + admin.getUsername() + ", 密码: " + admin.getPassword();
31+
}
32+
}

‎src/main/java/org/bewhale/javasec/controller/basevul/RedirectVul.java‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
package org.bewhale.javasec.controller.basevul;
2+
3+
import org.springframework.stereotype.Controller;
4+
import org.springframework.web.bind.annotation.RequestMapping;
5+
import org.springframework.web.servlet.ModelAndView;
6+
7+
import javax.servlet.http.HttpServletResponse;
8+
import java.io.IOException;
9+
10+
@Controller
11+
@RequestMapping("/home/redirect")
12+
public class RedirectVul {
13+
@RequestMapping("")
14+
public String redirect(String url) {
15+
return "redirect:" + url;
16+
}
17+
18+
//// public ModelAndView redirect(String url) {
19+
//// return new ModelAndView("redirect://" + url);
20+
//// }
21+
//
22+
// public void redirect(String url, HttpServletResponse response) throws IOException {
23+
// response.sendRedirect(url);
24+
// }
25+
}

‎src/main/java/org/bewhale/javasec/controller/basevul/SPELVul.java‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
package org.bewhale.javasec.controller.basevul;
2+
3+
import com.sun.deploy.net.HttpUtils;
4+
import org.springframework.expression.EvaluationContext;
5+
import org.springframework.expression.EvaluationException;
6+
import org.springframework.expression.ExpressionParser;
7+
import org.springframework.expression.ParseException;
8+
import org.springframework.expression.spel.standard.SpelExpressionParser;
9+
import org.springframework.expression.spel.support.StandardEvaluationContext;
10+
import org.springframework.stereotype.Controller;
11+
import org.springframework.ui.Model;
12+
import org.springframework.web.bind.annotation.RequestMapping;
13+
14+
@Controller
15+
@RequestMapping("/home/spel")
16+
public class SPELVul {
17+
18+
@RequestMapping("")
19+
public String spelVul(String exp, Model model) {
20+
try {
21+
// 1. 创建解析器：SpEL使用ExpressionParser接口表示解析器，提供SpelExpressionParser默认实现
22+
ExpressionParser parser = new SpelExpressionParser();
23+
// StandardEvaluationContext权限过大，可以执行任意代码
24+
EvaluationContext evaluationContext = new StandardEvaluationContext();
25+
26+
// 2. 解析表达式: 使用ExpressionParser的parseExpression来解析相应的表达式为Expression对象
27+
// 3. 求值：通过 Expression 接口的 getValue 方法根据上下文获得表达式值
28+
String result = parser.parseExpression(exp).getValue(evaluationContext).toString();
29+
model.addAttribute("results", result);
30+
} catch (ParseException e) {
31+
e.printStackTrace();
32+
model.addAttribute("results", e.toString());
33+
}
34+
return "/basevul/spel/spel";
35+
}
36+
}

‎src/main/java/org/bewhale/javasec/controller/basevul/SSRFVul.java‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
package org.bewhale.javasec.controller.basevul;
2+
3+
import org.bewhale.javasec.util.HTTP;
4+
import org.bewhale.javasec.util.Security;
5+
import org.springframework.stereotype.Controller;
6+
import org.springframework.ui.Model;
7+
import org.springframework.web.bind.annotation.RequestMapping;
8+
import org.springframework.web.bind.annotation.RequestParam;
9+
import org.springframework.web.bind.annotation.RestController;
10+
11+
@RestController
12+
@RequestMapping("/home/ssrf")
13+
public class SSRFVul {
14+
15+
@RequestMapping("")
16+
public String urlConnection(@RequestParam String url, String isHttp, String isIntranet) {
17+
if (url.equals("")) {
18+
return "请输入url";
19+
}
20+
21+
if (isHttp != null && isHttp.equals("true")) {
22+
if (!Security.isHttp(url)) {
23+
return "不允许非http/https协议!!!";
24+
}
25+
}
26+
if (isIntranet != null && isIntranet.equals("true")) {
27+
if (Security.isIntranet(url)) {
28+
return "不允许访问内网!!!";
29+
}
30+
}
31+
32+
String results = HTTP.URLConnection(url);
33+
34+
return results;
35+
}
36+
}

‎src/main/java/org/bewhale/javasec/controller/basevul/SSTIVul.java‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
package org.bewhale.javasec.controller.basevul;
2+
3+
import org.springframework.stereotype.Controller;
4+
import org.springframework.web.bind.annotation.RequestMapping;
5+
6+
@Controller
7+
@RequestMapping("/home/ssti")
8+
public class SSTIVul {
9+
10+
@RequestMapping("/thymeleaf")
11+
public String thymeleaf(String content) {
12+
return "user/" + content + "/welcome"; //template path is tainted
13+
}
14+
15+
@RequestMapping("/noreturn/{content}")
16+
public void noReturn(String content) {
17+
System.out.println("ok");
18+
}
19+
}

‎src/main/java/org/bewhale/javasec/controller/basevul/UnauthVul.java‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
package org.bewhale.javasec.controller.basevul;
2+
3+
import org.bewhale.javasec.model.Admin;
4+
import org.bewhale.javasec.service.AdminService;
5+
import org.springframework.beans.factory.annotation.Autowired;
6+
import org.apache.commons.lang.StringUtils;
7+
import org.springframework.ui.Model;
8+
import org.springframework.web.bind.annotation.RequestMapping;
9+
import org.springframework.web.bind.annotation.RestController;
10+
11+
import java.util.ArrayList;
12+
13+
14+
@RestController
15+
@RequestMapping("/unauth")
16+
public class UnauthVul {
17+
@Autowired
18+
@SuppressWarnings("all")
19+
AdminService adminService;
20+
21+
@RequestMapping("/userinfo")
22+
public String adminInfo(String username) {
23+
ArrayList<Admin> userInfo = new ArrayList<>();
24+
System.out.println(username);
25+
if (username.equals("")) {
26+
return "请输入用户名！";
27+
}
28+
if (username.equals("all")) {
29+
userInfo = adminService.getAllInfo();
30+
} else {
31+
Admin admin = adminService.getInfoByUserName(username);
32+
if (admin == null) {
33+
return "用户不存在!";
34+
}
35+
userInfo.add(admin);
36+
}
37+
return (StringUtils.strip(userInfo.toString(), "[]")).replace(", ", "");
38+
}
39+
}

‎src/main/java/org/bewhale/javasec/controller/basevul/XFFVul.java‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
package org.bewhale.javasec.controller.basevul;
2+
3+
import org.springframework.web.bind.annotation.RequestMapping;
4+
import org.springframework.web.bind.annotation.RestController;
5+
6+
import javax.servlet.http.HttpServletRequest;
7+
8+
@RestController
9+
@RequestMapping("/home/xff")
10+
public class XFFVul {
11+
12+
@RequestMapping("")
13+
public String xffVul(HttpServletRequest request,String xff) {
14+
String ip = request.getRemoteAddr();
15+
if (xff.equals("true")) {
16+
ip = request.getHeader("X-Forwarded-For");
17+
}
18+
if (ip != null && ip.equals("10.0.0.1")) {
19+
return "你的ip为: " + ip +", 访问成功。";
20+
}
21+
return "你的ip为: " + ip +", 本资源仅允许 10.0.0.1 访问。";
22+
23+
}
24+
}

‎src/main/java/org/bewhale/javasec/controller/basevul/XSSVul.java‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
package org.bewhale.javasec.controller.basevul;
2+
3+
import org.bewhale.javasec.model.Xss;
4+
import org.bewhale.javasec.service.XssService;
5+
import org.springframework.stereotype.Controller;
6+
import org.springframework.ui.Model;
7+
import org.springframework.web.bind.annotation.RequestMapping;
8+
9+
import java.util.List;
10+
11+
@Controller
12+
@RequestMapping("/home/xss")
13+
public class XSSVul {
14+
final XssService xssService;
15+
16+
public XSSVul(XssService xssService) {
17+
this.xssService = xssService;
18+
}
19+
20+
@RequestMapping("/reflect")
21+
public String xssReflect(String content, Model model) {
22+
model.addAttribute("results", content);
23+
return "/basevul/xss/reflect";
24+
}
25+
26+
@RequestMapping("/store")
27+
public String xssInsert(String content, String clear, Model model) {
28+
try {
29+
if (clear != null) {
30+
xssService.clear();
31+
model.addAttribute("results", "清除成功");
32+
return "/basevul/xss/store";
33+
}
34+
if (content !=null && !content.equals("")) {
35+
xssService.setContent(new Xss(content));
36+
model.addAttribute("results", "添加成功");
37+
}
38+
List<String> list = xssService.getContent();
39+
model.addAttribute("list", list);
40+
} catch (Exception e) {
41+
e.printStackTrace();
42+
model.addAttribute("results", e.toString());
43+
}
44+
return "/basevul/xss/store";
45+
}
46+
}

0 commit comments

Comments
 (0)