├── .gitignore ├── CHANGELOG.md ├── LICENSE ├── README.md ├── code-inspector-api ├── README.md ├── pom.xml └── src │ ├── main │ └── java │ │ └── code │ │ └── inspector │ │ └── api │ │ ├── CodeInspector.java │ │ └── CodeInspectorImpl.java │ └── test │ └── code │ └── inspector │ └── api │ └── Test.java ├── code-inspector-build ├── README.md ├── pom.xml └── src │ └── main │ └── java │ └── code │ └── inspector │ └── Build.java ├── code-inspector-const ├── README.md ├── pom.xml └── src │ └── main │ └── java │ └── code │ └── inspector │ └── core │ ├── Const.java │ └── Taint.java ├── code-inspector-core ├── README.md ├── pom.xml └── src │ └── main │ └── java │ └── code │ └── inspector │ ├── core │ ├── Application.java │ ├── Command.java │ ├── asm │ │ ├── DOSClassVisitor.java │ │ ├── DOSMethodAdapter.java │ │ ├── DesClassVisitor.java │ │ ├── DesMethodAdapter.java │ │ ├── RCEClassVisitor.java │ │ ├── RCEMethodAdapter.java │ │ ├── RedirectClassVisitor.java │ │ ├── RedirectMethodAdapter.java │ │ ├── SSRFClassVisitor.java │ │ ├── SSRFMethodAdapter.java │ │ ├── SqlInjectClassVisitor.java │ │ ├── SqlInjectMethodAdapter.java │ │ ├── base │ │ │ ├── BaseClassVisitor.java │ │ │ └── ParamTaintMethodAdapter.java │ │ └── system │ │ │ ├── CallGraphClassVisitor.java │ │ │ ├── CallGraphMethodAdapter.java │ │ │ ├── DiscoveryClassVisitor.java │ │ │ ├── MethodCallClassVisitor.java │ │ │ └── MethodCallMethodAdapter.java │ ├── data │ │ ├── DesCollector.java │ │ ├── DoSCollector.java │ │ ├── RCECollector.java │ │ ├── RedirectCollector.java │ │ ├── SSRFCollector.java │ │ └── SqlCollector.java │ ├── inherit │ │ ├── InheritanceMap.java │ │ └── InheritanceUtil.java │ └── service │ │ ├── DOSService.java │ │ ├── DesService.java │ │ ├── RCEService.java │ │ ├── RedirectService.java │ │ ├── SSRFService.java │ │ ├── SqlInjectService.java │ │ ├── base │ │ └── BaseService.java │ │ └── system │ │ ├── CallGraphService.java │ │ ├── DiscoveryService.java │ │ ├── InheritanceService.java │ │ ├── MethodCallService.java │ │ ├── SortService.java │ │ └── SpringService.java │ ├── data │ ├── Output.java │ └── ResultOutput.java │ ├── form │ ├── AuthorForm.form │ ├── AuthorForm.java │ ├── CodeInspector.form │ ├── CodeInspector.java │ ├── Graphviz.form │ ├── Graphviz.java │ ├── HowThisWork.form │ ├── HowThisWork.java │ └── module │ │ ├── DeserializationModule.form │ │ ├── DeserializationModule.java │ │ ├── DoSModule.form │ │ ├── DoSModule.java │ │ ├── RCEModule.form │ │ ├── RCEModule.java │ │ ├── RedirectModule.form │ │ ├── RedirectModule.java │ │ ├── SQLModule.form │ │ ├── SQLModule.java │ │ ├── SSRFModule.form │ │ └── SSRFModule.java │ └── log │ └── Log.java ├── code-inspector-demo ├── README.md ├── pom.xml └── src │ └── main │ └── java │ └── code │ └── inspector │ └── demo │ ├── DemoApplication.java │ ├── dao │ ├── SQLIDao.java │ └── impl │ │ └── SQLIDaoImpl.java │ ├── model │ ├── Message.java │ ├── Obj.java │ └── User.java │ ├── service │ ├── DOSService.java │ ├── DesService.java │ ├── RCEService.java │ ├── SQLIService.java │ ├── SSRFService.java │ └── impl │ │ ├── DOSServiceImpl.java │ │ ├── DesServiceImpl.java │ │ ├── RCEServiceImpl.java │ │ ├── RCEUtil.java │ │ ├── SQLIServiceImpl.java │ │ └── SSRFServiceImpl.java │ └── web │ ├── DOSController.java │ ├── DesController.java │ ├── RCEController.java │ ├── SQLIController.java │ ├── SSRFController.java │ └── URLController.java ├── code-inspector-graphviz ├── pom.xml └── src │ └── main │ ├── java │ └── code │ │ └── inspector │ │ └── graphviz │ │ └── GraphvizCore.java │ └── resources │ └── log4j.properties ├── code-inspector-jvm ├── README.md ├── pom.xml └── src │ └── main │ └── java │ └── code │ └── inspector │ └── jvm │ ├── CoreMethodAdapter.java │ ├── GotoState.java │ ├── LocalVariables.java │ └── OperandStack.java ├── code-inspector-model ├── README.md ├── pom.xml └── src │ └── main │ └── java │ └── code │ └── inspector │ └── model │ ├── CallGraph.java │ ├── ClassFile.java │ ├── ClassReference.java │ ├── MethodReference.java │ └── ResultInfo.java ├── code-inspector-render ├── README.md ├── pom.xml └── src │ └── main │ ├── java │ └── code │ │ └── inspector │ │ └── render │ │ ├── IOUtil.java │ │ ├── Render.java │ │ └── RenderData.java │ └── resources │ ├── prefix │ └── suffix ├── code-inspector-spring ├── README.md ├── pom.xml └── src │ └── main │ └── java │ └── code │ └── inspector │ └── core │ └── spring │ ├── SpringConstant.java │ ├── SpringController.java │ ├── SpringMapping.java │ ├── SpringParam.java │ └── asm │ ├── SpringAnnoAdapter.java │ ├── SpringClassVisitor.java │ ├── SpringMethodAdapter.java │ └── SpringPathAnnoAdapter.java ├── code-inspector-starter ├── README.md ├── pom.xml └── src │ └── main │ └── java │ └── code │ └── inspector │ └── start │ └── Application.java ├── code-inspector-util ├── README.md ├── pom.xml └── src │ └── main │ └── java │ └── code │ └── inspector │ └── core │ └── util │ ├── ClassUtil.java │ ├── DirUtil.java │ ├── ExecUtil.java │ ├── IOUtil.java │ ├── JarUtil.java │ └── OSUtil.java ├── doc ├── ACHIEVE.md ├── CHAINS.md ├── LABEL.md ├── NEW.md ├── QUESTIONS.md └── TAINT.md ├── images ├── 00000.png ├── 00001.png ├── 00002.png ├── 00003.png ├── 00004.png ├── 00005.png ├── 00006.png ├── 00007.png ├── 00008.png ├── 00009.png ├── 00010.png ├── 00011.png ├── 00012.png └── 00013.png ├── pom.xml └── target-list.txt /.gitignore: -------------------------------------------------------------------------------- 1 | .idea/ 2 | target/ 3 | *.jar 4 | -------------------------------------------------------------------------------- /CHANGELOG.md: -------------------------------------------------------------------------------- 1 | ## 0.1-beta 2 | 3 | 初始版本 4 | 5 | ## 0.2-beta 6 | 7 | 没有新功能，主要是修复关键BUG，代码优化 8 | 9 | 更新内容： 10 | - [important] [bug] 分支处理的BUG #1 11 | - [bug] debug模式的call graph输出有问题 #5 12 | - [bug] 拼接字符串操作应该加入call graph默认规则 #6 13 | - [improve] SPEL检测逻辑需要加强 #2 14 | - [improve] snakeyaml 规则加强 #7 15 | - [feat] 应该提供对war包的支持 #3 16 | - 提取工具类，新增Maven模块 17 | - 优化代码，小幅提高扫描效率 18 | - 补充README部分 19 | 20 | ## 0.3-beta 21 | 22 | 更新内容： 23 | - [feat] 添加Graphviz输出图片 #8 -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2023 4ra1n 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # code-inspector 2 | 3 | ![](https://img.shields.io/badge/build-passing-brightgreen) 4 | ![](https://img.shields.io/badge/ASM-9.4-blue) 5 | ![](https://img.shields.io/badge/Java-8-red) 6 | ![](https://img.shields.io/badge/Line-6176-yellow) 7 | 8 | **注意：本项目是一个学习项目，可能不会长期维护，作者精力有限，欢迎大佬们二次开发** 9 | 10 | 一个Java自动代码审计工具，尤其针对SpringBoot框架，也可自行改造以适配其他情况 11 | 12 | 提供一个SpringBoot的Jar包即可进行自动代码审计并生成报告，底层技术基于字节码分析 13 | 14 | ![](images/00000.png) 15 | 16 | 由于没有真正的执行，例如无法识别过滤等操作，所以会存在误报`false positive` 17 | 18 | 注意：漏洞检测并不是简单地检测某个方法内是否包含敏感方法，而是从每个`Controller`的每个`Mapping`的每一个用户可控参数开始分析与追踪，构建出方法调用链，分析这个参数在整个链路的过程 19 | 20 | ## 成果 21 | 22 | [漏洞扫描成果](doc/ACHIEVE.md) 23 | 24 | ## 使用`GUI`启动器 25 | 26 | 选择好你的`Jar`包后点击`Start`即可，默认开启所有配置 27 | 28 | 注意：目标`Jar`是`Java 8`编译的情况下兼容性最佳，高版本`Java`可能优化指令导致与原规则不匹配产生漏报 29 | 30 | 选项： 31 | - import rt.jar 绝大多数情况请勿勾选 32 | - analyze all libs 绝大多数情况请勿勾选 33 | - debug mode 保存一些临时的分析结果到当前目录中 34 | 35 | ![](images/00006.png) 36 | 37 | ### DoS 38 | 39 | 配置`DoS`模块： 40 | - `for`循环停止条件可控 41 | - 正则规则和输入同时可控 42 | - 数组初始化大小可控 43 | - `ArrayList`初始化大小可控 44 | 45 | ![](images/00007.png) 46 | 47 | ### RCE 48 | 49 | 配置`RCE`模块： 50 | - `Runtime.exec`直接/拼接执行命令 51 | - `ProcessBuilder`直接/拼接执行命令 52 | - `JNDI`注入导致RCE（`lookup`内容可控） 53 | - `GroovyShell.evaluate`直接/拼接执行命令 54 | - `Spring EL`直接/拼接执行命令 55 | 56 | ![](images/00008.png) 57 | 58 | ### SSRF 59 | 60 | 配置`SSRF`模块： 61 | - `HttpUrlConnection`请求 62 | - `Apache HttpClient`请求 63 | - `Socket`建立新连接 64 | - `OKHttp`请求 65 | 66 | ![](images/00009.png) 67 | 68 | ### SQL Injection 69 | 70 | 配置`SQL Injection`模块： 71 | - `JdbcTemplate.update`存在字符串拼接 72 | - `JdbcTemplate.execute`存在字符串拼接 73 | - `JdbcTemplate.queryAny`存在字符串拼接 74 | - `Statement.executeQuery`存在字符串拼接 75 | - `Statement.executeUpdate`存在字符串拼接 76 | - `Statement.execute`存在字符串拼接 77 | 78 | ![](images/00010.png) 79 | 80 | ### Open Redirect 81 | 82 | 配置`Redirect`模块： 83 | - 使用`HttpServletResponse.sendRedirect`重定向 84 | - 使用`SpringMVC`直接返回`String`可控 85 | - 使用`SpringMVC`返回`ModelAndView`可控 86 | 87 | ![](images/00011.png) 88 | 89 | ### Deserialization 90 | 91 | 配置`Deserialization`模块： 92 | - `Java`原生反序列化 93 | - `Fastjson`反序列化 94 | - `SnakeYAML`反序列化 95 | - `Jackson`反序列化 96 | - `Hessian2`反序列化 97 | - `XMLDecoder`反序列化 98 | 99 | ![](images/00012.png) 100 | 101 | ## 使用`API` 102 | 103 | 可以使用以下的方式方便地进行扫描，注意三个`boolean`参数绝大多数情况应该设置为`false` 104 | 105 | ```java 106 | public static void testRCE() { 107 | CodeInspector inspector = new CodeInspectorImpl(); 108 | List results = inspector.analyzeRCE( 109 | "your/path/to/jar/file", 110 | false, false, false); 111 | System.out.println(results.size()); 112 | } 113 | ``` 114 | 115 | ## Graphviz 116 | 117 | 指定`Controller`类名和`Mapping`的方法名，以及分析的参数索引，即可画图 118 | 119 | ![](images/00013.png) 120 | 121 | ## 常见问题 122 | 123 | [常见问题](doc/QUESTIONS.md) 124 | 125 | ## 如何构建方法调用链 126 | 127 | [如何构建方法调用链](doc/CHAINS.md) 128 | 129 | ## 如何处理分支 130 | 131 | [如何处理分支](doc/LABEL.md) 132 | 133 | ## 通用污点传递规则 134 | 135 | [通用污点传递规则](doc/TAINT.md) 136 | 137 | ## 如何编写新规则 138 | 139 | [如何编写新规则](doc/NEW.md) -------------------------------------------------------------------------------- /code-inspector-api/README.md: -------------------------------------------------------------------------------- 1 | # code-inspector-api 2 | 3 | 该模块提供了通过代码启动扫描的方式 -------------------------------------------------------------------------------- /code-inspector-api/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 6 | code-inspector 7 | n1ar4 8 | 0.2-beta 9 | 10 | 4.0.0 11 | 12 | code-inspector-api 13 | 14 | 15 | 8 16 | 8 17 | UTF-8 18 | 19 | 20 | 21 | 22 | n1ar4 23 | code-inspector-core 24 | compile 25 | 0.2-beta 26 | 27 | 28 | 29 | -------------------------------------------------------------------------------- /code-inspector-api/src/main/java/code/inspector/api/CodeInspector.java: -------------------------------------------------------------------------------- 1 | package code.inspector.api; 2 | 3 | import code.inspector.model.ResultInfo; 4 | 5 | import java.util.List; 6 | 7 | public interface CodeInspector { 8 | List analyzeAll(String jarPath, boolean isDebug, boolean useRt, boolean allLib); 9 | 10 | List analyzeRCE(String jarPath, boolean isDebug, boolean useRt, boolean allLib); 11 | 12 | List analyzeSSRF(String jarPath, boolean isDebug, boolean useRt, boolean allLib); 13 | 14 | List analyzeRedirect(String jarPath, boolean isDebug, boolean useRt, boolean allLib); 15 | 16 | List analyzeSQLInjection(String jarPath, boolean isDebug, boolean useRt, boolean allLib); 17 | 18 | List analyzeDeserialization(String jarPath, boolean isDebug, boolean useRt, boolean allLib); 19 | 20 | List analyzeDoS(String jarPath, boolean isDebug, boolean useRt, boolean allLib); 21 | } 22 | 23 | -------------------------------------------------------------------------------- /code-inspector-api/src/test/code/inspector/api/Test.java: -------------------------------------------------------------------------------- 1 | package code.inspector.api; 2 | 3 | import code.inspector.model.ResultInfo; 4 | 5 | import java.util.List; 6 | 7 | @SuppressWarnings("all") 8 | public class Test { 9 | 10 | public static void testRCE() { 11 | CodeInspector inspector = new CodeInspectorImpl(); 12 | List results = inspector.analyzeRCE( 13 | "./bin/code-inspector-demo-0.1-beta.jar", 14 | false, false, false); 15 | for (ResultInfo r : results) { 16 | System.out.println(r.getType() + ":" + r.getVulName()); 17 | } 18 | } 19 | 20 | public static void testSSRF() { 21 | CodeInspector inspector = new CodeInspectorImpl(); 22 | List results = inspector.analyzeSSRF( 23 | "./bin/code-inspector-demo-0.1-beta.jar", 24 | false, false, false); 25 | for (ResultInfo r : results) { 26 | System.out.println(r.getType() + ":" + r.getVulName()); 27 | } 28 | } 29 | 30 | public static void testDoS() { 31 | CodeInspector inspector = new CodeInspectorImpl(); 32 | List results = inspector.analyzeDoS( 33 | "./bin/code-inspector-demo-0.1-beta.jar", 34 | false, false, false); 35 | for (ResultInfo r : results) { 36 | System.out.println(r.getType() + ":" + r.getVulName()); 37 | } 38 | } 39 | 40 | public static void testDeserialization() { 41 | CodeInspector inspector = new CodeInspectorImpl(); 42 | List results = inspector.analyzeDeserialization( 43 | "./bin/code-inspector-demo-0.1-beta.jar", 44 | false, false, false); 45 | for (ResultInfo r : results) { 46 | System.out.println(r.getType() + ":" + r.getVulName()); 47 | } 48 | } 49 | 50 | public static void testSQLInjection() { 51 | CodeInspector inspector = new CodeInspectorImpl(); 52 | List results = inspector.analyzeSQLInjection( 53 | "./bin/code-inspector-demo-0.1-beta.jar", 54 | false, false, false); 55 | for (ResultInfo r : results) { 56 | System.out.println(r.getType() + ":" + r.getVulName()); 57 | } 58 | } 59 | 60 | public static void testRedirect() { 61 | CodeInspector inspector = new CodeInspectorImpl(); 62 | List results = inspector.analyzeRedirect( 63 | "./bin/code-inspector-demo-0.1-beta.jar", 64 | false, false, false); 65 | for (ResultInfo r : results) { 66 | System.out.println(r.getType() + ":" + r.getVulName()); 67 | } 68 | } 69 | 70 | public static void testAll() { 71 | CodeInspector inspector = new CodeInspectorImpl(); 72 | List results = inspector.analyzeAll( 73 | "./bin/code-inspector-demo-0.1-beta.jar", 74 | false, false, false); 75 | for (ResultInfo r : results) { 76 | System.out.println(r.getType() + ":" + r.getVulName()); 77 | } 78 | } 79 | 80 | public static void testTarget() { 81 | CodeInspector inspector = new CodeInspectorImpl(); 82 | List results = inspector.analyzeRCE( 83 | "./bin/code-inspector-demo-0.1-beta.jar", 84 | false, false, false); 85 | for (ResultInfo r : results) { 86 | System.out.println(r.getType() + ":" + r.getVulName()); 87 | } 88 | } 89 | 90 | public static void main(String[] args) { 91 | testSSRF(); 92 | } 93 | } 94 | -------------------------------------------------------------------------------- /code-inspector-build/README.md: -------------------------------------------------------------------------------- 1 | # code-inspector-build 2 | 3 | 该模块仅用于build前更新版本 -------------------------------------------------------------------------------- /code-inspector-build/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 6 | code-inspector 7 | n1ar4 8 | 0.2-beta 9 | 10 | 4.0.0 11 | 12 | code-inspector-build 13 | 14 | 15 | 8 16 | 8 17 | UTF-8 18 | 19 | 20 | -------------------------------------------------------------------------------- /code-inspector-build/src/main/java/code/inspector/Build.java: -------------------------------------------------------------------------------- 1 | package code.inspector; 2 | 3 | import java.nio.file.Files; 4 | import java.nio.file.Path; 5 | import java.nio.file.Paths; 6 | 7 | public class Build { 8 | static String oldVersion = "0.2-beta"; 9 | static String newVersion = "0.3-beta"; 10 | 11 | public static void main(String[] args) throws Exception { 12 | Path rootPom = Paths.get("pom.xml"); 13 | Path apiPom = Paths.get("code-inspector-api/pom.xml"); 14 | Path buildPom = Paths.get("code-inspector-build/pom.xml"); 15 | Path constPom = Paths.get("code-inspector-const/pom.xml"); 16 | Path corePom = Paths.get("code-inspector-core/pom.xml"); 17 | Path demoPom = Paths.get("code-inspector-demo/pom.xml"); 18 | Path jvmPom = Paths.get("code-inspector-jvm/pom.xml"); 19 | Path modelPom = Paths.get("code-inspector-model/pom.xml"); 20 | Path renderPom = Paths.get("code-inspector-render/pom.xml"); 21 | Path springPom = Paths.get("code-inspector-spring/pom.xml"); 22 | Path starterPom = Paths.get("code-inspector-starter/pom.xml"); 23 | Path utilPom = Paths.get("code-inspector-util/pom.xml"); 24 | Path starterCode = Paths.get("code-inspector-starter/src/main/java/" + 25 | "code/inspector/start/Application.java"); 26 | 27 | replace(rootPom); 28 | replace(apiPom); 29 | replace(buildPom); 30 | replace(constPom); 31 | replace(corePom); 32 | replace(demoPom); 33 | replace(jvmPom); 34 | replace(modelPom); 35 | replace(renderPom); 36 | replace(springPom); 37 | replace(starterPom); 38 | replace(utilPom); 39 | replace(starterCode); 40 | } 41 | 42 | private static void replace(Path path) throws Exception { 43 | byte[] data = Files.readAllBytes(path); 44 | String newData = new String(data).replace(oldVersion, newVersion); 45 | Files.write(path, newData.getBytes()); 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /code-inspector-const/README.md: -------------------------------------------------------------------------------- 1 | # code-inspector-const 2 | 3 | 该模块是项目用到到常量 -------------------------------------------------------------------------------- /code-inspector-const/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 6 | code-inspector 7 | n1ar4 8 | 0.2-beta 9 | 10 | 4.0.0 11 | 12 | code-inspector-const 13 | 14 | 15 | 8 16 | 8 17 | UTF-8 18 | 19 | 20 | -------------------------------------------------------------------------------- /code-inspector-const/src/main/java/code/inspector/core/Const.java: -------------------------------------------------------------------------------- 1 | package code.inspector.core; 2 | 3 | public interface Const { 4 | // DOS 5 | String DOS_MODULE = "DOS_MODULE"; 6 | String DOS_FOR_TYPE = "DOS_FOR_TYPE"; 7 | String DOS_ARRAY_TYPE = "DOS_ARRAY_TYPE"; 8 | String DOS_LIST_TYPE = "DOS_LIST_TYPE"; 9 | String DOS_REGEX_TYPE = "DOS_REGEX_TYPE"; 10 | // RCE 11 | String RCE_MODULE = "RCE_MODULE"; 12 | String RCE_RUNTIME_TYPE = "RCE_RUNTIME_TYPE"; 13 | String RCE_PROCESS_TYPE = "RCE_PROCESS_TYPE"; 14 | String RCE_GROOVY_TYPE = "RCE_GROOVY_TYPE"; 15 | String RCE_JNDI_TYPE = "RCE_JNDI_TYPE"; 16 | String RCE_SP_EL_TYPE = "RCE_SP_EL_TYPE"; 17 | // Redirect 18 | String REDIRECT_MODULE = "REDIRECT_MODULE"; 19 | String REDIRECT_STRING_TYPE = "REDIRECT_STRING_TYPE"; 20 | String REDIRECT_SEND_RESPONSE_TYPE = "REDIRECT_SEND_RESPONSE_TYPE"; 21 | String REDIRECT_MODEL_AND_VIEW_TYPE = "REDIRECT_MODEL_AND_VIEW_TYPE"; 22 | // SQL Injection 23 | String SQL_MODULE = "SQL_MODULE"; 24 | String SQL_JDBC_TEMPLATE_UPDATE = "SQL_JDBC_TEMPLATE_UPDATE"; 25 | String SQL_JDBC_TEMPLATE_EXECUTE = "SQL_JDBC_TEMPLATE_EXECUTE"; 26 | String SQL_JDBC_TEMPLATE_QUERY_ANY = "SQL_JDBC_TEMPLATE_QUERY_ANY"; 27 | String SQL_EXECUTE_UPDATE = "SQL_EXECUTE_UPDATE"; 28 | String SQL_EXECUTE_QUERY = "SQL_EXECUTE_QUERY"; 29 | String SQL_EXECUTE = "SQL_EXECUTE"; 30 | // SSRF 31 | String SSRF_MODULE = "SSRF_MODULE"; 32 | String SSRF_JDK_TYPE = "SSRF_JDK_TYPE"; 33 | String SSRF_APACHE_TYPE = "SSRF_APACHE_TYPE"; 34 | String SSRF_OKHTTP_TYPE = "SSRF_OKHTTP_TYPE"; 35 | String SSRF_SOCKET_TYPE = "SSRF_SOCKET_TYPE"; 36 | // Deserialization 37 | String DESERIALIZATION_MODULE = "DESERIALIZATION_MODULE"; 38 | String DESERIALIZATION_JDK = "DESERIALIZATION_JDK"; 39 | String DESERIALIZATION_FASTJSON = "DESERIALIZATION_FASTJSON"; 40 | String DESERIALIZATION_JACKSON = "DESERIALIZATION_JACKSON"; 41 | String DESERIALIZATION_SNAKEYAML = "DESERIALIZATION_SNAKEYAML"; 42 | String DESERIALIZATION_HESSIAN = "DESERIALIZATION_HESSIAN"; 43 | String DESERIALIZATION_XML_DECODER = "DESERIALIZATION_XML_DECODER"; 44 | } 45 | -------------------------------------------------------------------------------- /code-inspector-const/src/main/java/code/inspector/core/Taint.java: -------------------------------------------------------------------------------- 1 | package code.inspector.core; 2 | 3 | public interface Taint { 4 | String PARAM_TAINT = "PARAM-TAINT"; 5 | String BUILD_STRING = "BUILD_STRING"; 6 | String TO_STRING = "TO_STRING"; 7 | String PROCESS_INIT = "PROCESS_INIT"; 8 | String MODEL_AND_VIEW = "MODEL_AND_VIEW"; 9 | String LIST_INIT = "LIST_INIT"; 10 | String SPRING_STANDARD = "SPRING_STANDARD"; 11 | String YAML_INIT = "YAML_INIT"; 12 | } 13 | -------------------------------------------------------------------------------- /code-inspector-core/README.md: -------------------------------------------------------------------------------- 1 | # code-inspector-core 2 | 3 | 项目核心模块，其中包含了GUI代码和核心代码 -------------------------------------------------------------------------------- /code-inspector-core/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 6 | code-inspector 7 | n1ar4 8 | 0.2-beta 9 | 10 | 4.0.0 11 | 12 | code-inspector-core 13 | 14 | 15 | n1ar4 16 | code-inspector-const 17 | compile 18 | 0.2-beta 19 | 20 | 21 | n1ar4 22 | code-inspector-util 23 | compile 24 | 0.2-beta 25 | 26 | 27 | n1ar4 28 | code-inspector-render 29 | 0.2-beta 30 | compile 31 | 32 | 33 | n1ar4 34 | code-inspector-jvm 35 | compile 36 | 0.2-beta 37 | 38 | 39 | n1ar4 40 | code-inspector-spring 41 | 0.2-beta 42 | compile 43 | 44 | 45 | n1ar4 46 | code-inspector-graphviz 47 | 0.2-beta 48 | compile 49 | 50 | 51 | 52 | 53 | 8 54 | 8 55 | UTF-8 56 | 57 | 58 | -------------------------------------------------------------------------------- /code-inspector-core/src/main/java/code/inspector/core/Command.java: -------------------------------------------------------------------------------- 1 | package code.inspector.core; 2 | 3 | import java.util.ArrayList; 4 | import java.util.HashMap; 5 | import java.util.List; 6 | 7 | public class Command { 8 | public List jars; 9 | public String module; 10 | public boolean isDebug; 11 | public boolean jdk; 12 | public boolean springBoot; 13 | public boolean lib; 14 | public String path; 15 | public String packageName; 16 | private HashMap options = new HashMap<>(); 17 | 18 | public void setOptions(HashMap options) { 19 | this.options = options; 20 | } 21 | 22 | public HashMap getOptions(){ 23 | return this.options; 24 | } 25 | public Command(){ 26 | this.jars = new ArrayList<>(); 27 | this.module = ""; 28 | this.isDebug = false; 29 | this.jdk = false; 30 | this.springBoot = true; 31 | this.lib = false; 32 | this.path = "result.html"; 33 | this.packageName = ""; 34 | } 35 | } 36 | -------------------------------------------------------------------------------- /code-inspector-core/src/main/java/code/inspector/core/asm/DOSClassVisitor.java: -------------------------------------------------------------------------------- 1 | package code.inspector.core.asm; 2 | 3 | 4 | import code.inspector.core.asm.base.BaseClassVisitor; 5 | import code.inspector.model.MethodReference; 6 | 7 | public class DOSClassVisitor extends BaseClassVisitor { 8 | public DOSClassVisitor(MethodReference.Handle targetMethod, int targetIndex) { 9 | super(targetMethod, targetIndex, DOSMethodAdapter.class); 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /code-inspector-core/src/main/java/code/inspector/core/asm/DOSMethodAdapter.java: -------------------------------------------------------------------------------- 1 | package code.inspector.core.asm; 2 | 3 | import code.inspector.core.Application; 4 | import code.inspector.core.Const; 5 | import code.inspector.core.Taint; 6 | import code.inspector.core.asm.base.ParamTaintMethodAdapter; 7 | import org.objectweb.asm.Label; 8 | import org.objectweb.asm.MethodVisitor; 9 | import org.objectweb.asm.Opcodes; 10 | 11 | import java.util.ArrayList; 12 | import java.util.List; 13 | import java.util.Map; 14 | 15 | public class DOSMethodAdapter extends ParamTaintMethodAdapter { 16 | private final Map pass; 17 | private static List flag = new ArrayList<>(); 18 | private final List