第六章 OWASP Top 10 2017 之外常见漏洞代码审计

1.CSRF

Referer过滤不严

if((referer!=null) && (referer.trim().startsWith("www.testdomain.com"))){}

　　

2.SSRF

String url=request.getParameter("url");
    URL u=new URL(url);
    URLConnection urlConnection=u.openConnection();
    HttpURLConnection httpURLConnection=(HttpURLConnection)urlConnection;
    BufferedReader base=new BufferedReader(new InputStreamReader(httpURLConnection.getInputStream(),"UTF-8"));

　　

函数

HttpClient.execute()

HttpClient.executeMethod()

HttpURLConnection.concert()

HttpURLConnection.getInputStream()

URL.openStream()

HttpServletRequest()

BasicHttpEntityEnclosingRequest()

DefaultBHttpClientConnection()

BasicHttpRequest

 

3.URL跳转

response.sendRedirect(url);

　　

错误的限制url=http://[e-mail]

String trustUrl="http://www.baidu.com";
    String url=request.getParameter("url");
    String getUrl=url.substring(0, trustUrl.length());
    if (getUrl.equals(trustUrl)){
        response.sendRedirect(url);
    }

　　

4.文件上传

错误判断文件名后缀

String suffixName=fileName.substring(fileName.indexOf("."),fileName.length());

　　

重点关注的类

函数或类名

File

lastIndexOf

indexOf

Fileupload

getRealPath

getServletPath

getPathInfo

getContentType

equalsIgnoredCase

FileUtils

MultipartFile

MultipartRequestEntity

UploadHandleServlet

FileLoadServlet

getInputStream

DiskFileItemFactory

 

任意文件下载

主要关注

FileInputStream

String filename=request.getParameter("filename");
    InputStream inputStream=new FileInputStream(filename);
    byte[] b =new byte[1024];
    int len=0;
    while ((len= inputStream.read(b))>0){
        response.getOutputStream().write(b,0,len);
    }
    response.getOutputStream().close();
    inputStream.close();

　　

6.5WEB后门

java.lang.Runtime.exec()

java.lang.ProcessBuilder.start()

6.6逻辑漏洞

略

6.7前端不安全配置

略

6.8拒绝服务

略

6.9点击劫持

略

6.10 http参数污染

略