0x00 Preface
I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes the process.
This series is primarily forreaders with basic Java syntax knowledge. Topics include audit environments; SQL, XSS, SSRF, RCE, file inclusion, and serialization vulnerabilities; classic Struts2 and WebLogic flaws; and Fastjson and Jackson analysis. The order may change, but the scope will remain. I hope the series is useful.
0x01 Audit Tools and Environment
-
MyEclipse 2017 CI
-
Intellij idea
-
Tomcat 7.0
-
MySQL 8.0.15
-
Java 1.8.0
-
macOS 10.15
Tutorials for installing and using these tools are widely available, so the details are omitted.
Cracking MyEclipse 2017 CI:
-
On Windows
-
On macOS
Creating a Java Web Project and Basic Servlet in IntelliJ IDEA:
https://www.cnblogs.com/javabg/p/7976977.html
Configuring Tomcat in MyEclipse:
https://www.cnblogs.com/xusweeter/p/9393721.html
0x02 Fundamentals
1. Package Naming Conventions
Java projects contain many kinds of packages, generally named as follows:
- indi ：
Individual project: initiated by one person but completed with others; may be public or private, with copyright primarily belonging to the initiator.
Package name:indi.initiator.project.module.…
- pers：
Personal project: initiated and completed by one person, shareable, with copyright primarily owned by that person.
Package name:pers.person.project.module.…
- priv：
Private project: initiated and completed by one person for nonpublic use; copyright belongs to that person.
Package name:priv.person.project.module.…
- onem：
Equivalent to 'indi'; 'indi' is recommended.
- team：
Team project: initiated and developed by a team; copyright belongs to that team.
Package name:team.teamName.project.module.…
- com：
Company project: copyright belongs to the company that initiated it.
Package name:com.company.project.module.…
Persistence layer: dao, persist, mapper
Entity classes: entity, model, bean, javabean, pojo
Business logic: service, biz
Controller: controller, servlet, action, web
Filter: filter
Exceptions: exception
Listener: listener
Package naming varies by framework, but the general pattern is similar: Java files are grouped and named by function.
2、servlet
Why introduce Servlets?
The series explains both vulnerability theory and real vulnerable Java code. The examples are simple Servlets I wrote, so their features and fundamentals must be understood first.I recommend writing a small web project containing the vulnerability yourself.. You should also know how to fix each vulnerability, which improves understanding.
What Is a Servlet?
A Java Servlet runs in a web or application server and acts as an intermediary between requests from browsers or HTTP clients and databases or applications on the server.
A Servlet performs these main tasks:
- Read explicit data sent by the client, including HTML forms and data from applets or custom HTTP clients.
- Read implicit HTTP request data from the browser, including cookies, media types, and supported compression formats.
- Process data and generate a result, possibly by accessing a database, making RMI or CORBA calls, invoking a web service, or calculating a response directly.
- Send explicit data—the document—to the browser. It may be text such as HTML or XML, binary data such as GIF, an Excel file, or another format.
- Send implicit HTTP response metadata, including content type, cookies, caching parameters, and similar information.
Servlet Lifecycle
A Servlet lifecycle runs from creation to destruction through these stages:
- A Servlet calls
init ()method initializes the Servlet. - The Servlet invokes
service()method to handle client requests. - A Servlet calls
destroy()method terminates the Servlet.
Finally, the JVM garbage collector reclaims the Servlet.
This section introducesservice() method.
service() is the principal method performing the actual task. The Servlet container calls service() method handles browser requests and writes formatted responses. The server creates a new thread and invokes service for each Servlet request.service() checks the HTTP method—GET, POST, PUT, DELETE, and so on—and calls doGet, doPost, doPut, or doDelete as appropriate.
public void service(ServletRequest request,
ServletResponse response)
throws ServletException, IOException{
}
The code above is aservice()method behavior
0x03 Conclusion
These fundamentals are enough to begin the auditing journey.