源:
评:
1. MySQL configuration
Ensure that you follow these instructions as variations can cause problems.
Create a new test user, a new database and a single test table. Your MySQL user must have a password assigned. The driver will fail if you try to connect with an empty password.
mysql> GRANT ALL PRIVILEGES ON *.* TO javauser@localhost -> IDENTIFIED BY 'javadude' WITH GRANT OPTION; mysql> create database javatest; mysql> use javatest; mysql> create table testdata ( -> id int not null auto_increment primary key, -> foo varchar(25), -> bar int); |
||
Note: the above user should be removed once testing is complete!
Next insert some test data into the testdata table.
mysql> insert into testdata values(null, 'hello', 12345); Query OK, 1 row affected (0.00 sec) mysql> select * from testdata; +----+-------+-------+ | ID | FOO | BAR | +----+-------+-------+ | 1 | hello | 12345 | +----+-------+-------+ 1 row in set (0.00 sec) mysql> |
||
2. Context configuration
Configure the JNDI DataSource in Tomcat by adding a declaration for your resource to your Context.
For example:
<Context> <!-- maxActive: Maximum number of database connections in pool. Make sure you configure your mysqld max_connections large enough to handle all of your db connections. Set to -1 for no limit. --> <!-- maxIdle: Maximum number of idle database connections to retain in pool. Set to -1 for no limit. See also the DBCP documentation on this and the minEvictableIdleTimeMillis configuration parameter. --> <!-- maxWait: Maximum time to wait for a database connection to become available in ms, in this example 10 seconds. An Exception is thrown if this timeout is exceeded. Set to -1 to wait indefinitely. --> <!-- username and password: MySQL username and password for database connections --> <!-- driverClassName: Class name for the old mm.mysql JDBC driver is org.gjt.mm.mysql.Driver - we recommend using Connector/J though. Class name for the official MySQL Connector/J driver is com.mysql.jdbc.Driver. --> <!-- url: The JDBC connection url for connecting to your MySQL database. --> <Resource name="jdbc/TestDB" auth="Container" type="javax.sql.DataSource" maxActive="100" maxIdle="30" maxWait="10000" username="javauser" password="javadude" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://localhost:3306/javatest"/> </Context> |
||
3. web.xml configuration
Now create a WEB-INF/web.xml
for this test application.
<web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" version="2.4"> <description>MySQL Test App</description> <resource-ref> <description>DB Connection</description> <res-ref-name>jdbc/TestDB</res-ref-name> <res-type>javax.sql.DataSource</res-type> <res-auth>Container</res-auth> </resource-ref> </web-app> |
||
4. Test code
Now create a simple test.jsp
page for use later.
<%@ taglib uri="http://java.sun.com/jsp/jstl/sql" prefix="sql" %> <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %> <sql:query var="rs" dataSource="jdbc/TestDB"> select id, foo, bar from testdata </sql:query> <html> <head> <title>DB Test</title> </head> <body> <h2>Results</h2> <c:forEach var="row" items="${rs.rows}"> Foo ${row.foo}<br/> Bar ${row.bar}<br/> </c:forEach> </body> </html> |
||
That JSP page makes use of JSTL's SQL and Core taglibs. You can get it from Apache Tomcat Taglibs - Standard Tag Library project — just make sure you get a 1.1.x or later release. Once you have JSTL, copy jstl.jar
and standard.jar
to your web app's WEB-INF/lib
directory.
Finally deploy your web app into $CATALINA_BASE/webapps
either as a warfile called DBTest.war
or into a sub-directory called DBTest
Once deployed, point a browser at http://localhost:8080/DBTest/test.jsp
to view the fruits of your hard work.
相关推荐
java asm jndi_JNDI-Injection-Exploit,用于log4j2漏洞验证 可执行程序为jar包,在命令行中运行以下命令: $ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar [-C] [command] [-A] [address] 其中: -C ...
$ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar [-C] [command] [-A] [address] where: -C - command executed in the remote classfile. (optional , default command is "open /Applications/...
标题"JNDI-Injection-Exploit-1.0-SNAPSHOT-all.zip"暗示了这是一个关于JNDI注入漏洞的exploit工具包,版本为1.0 SNAPSHOT,可能包含了多个利用示例或攻击代码。"all"可能表示该压缩包包含了所有相关的组件或测试...
该压缩包"JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar"可能包含了一个JNDI注入攻击的示例或者测试工具,"SNAPSHOT"通常表示这是一个开发中的版本,可能尚未经过完整测试,因此可能存在漏洞或不稳定性。使用这样的...
# JNDI-Inject-Exploit ## 免责声明 本工具仅面向**合法授权的企业安全测试**,如您需测试本工具的可用性请自行搭建靶机环境,在使用本工具进行检测时,您应确保该行为符合当地的法律法规,并且已经取得了足够的...
标题中的"jndi-1_2_1.zip_jndi_jndi-1.2.1.jar"表明这是一个关于JNDI的版本1.2.1的开源软件包,其中包含了一个名为"jndi-1.2.1.jar"的JAR文件。这个JAR文件包含了JNDI库的所有实现,使得开发者可以在他们的Java项目...
JNDI注入漏洞 描述 JNDI-Injection-Exploit是用于生成可用的JNDI链接并通过启动RMI服务器,... 我们可以用JNDI-Injection-Exploit生成的链接替换“ rmi://127.0.0.1:1099 / Object”,以测试漏洞。 免责声明 所有信
<jndi-name>java:comp/env/ejb/MyEntityBean</jndi-name> <prim-key-class>java.lang.Long</prim-key-class> <cmp-field> <field-name>myBlobData</field-name> <column-name>BLOB_DATA</column-name> <sql-...
其次,"jndi.properties"文件是用来配置JNDI的,JNDI是一个接口,允许Java程序查找和绑定命名服务。在EJB+JPA环境中,它通常用于定义数据源(DataSource)的JNDI名称,这样应用就可以通过这个名字找到并连接到数据库...
自用CVE-2018-3191 weblogic反序列化exp。
jar包,官方版本,自测可用
jar包,官方版本,自测可用
jar包,官方版本,自测可用
jar包,官方版本,自测可用
jar包,官方版本,自测可用
jar包,官方版本,自测可用
jar包,官方版本,自测可用
jar包,官方版本,自测可用
jar包,官方版本,自测可用