From 3ea2613273839c08164f7e3e69e4c477c6ee27c4 Mon Sep 17 00:00:00 2001 From: 4ra1n <2023503307@qq.com> Date: Tue, 12 Nov 2024 17:39:46 +0800 Subject: [PATCH] release v1.1.0 --- CHANGELOG.md | 41 ++++++ README.md | 139 +++++++++++++++---- assets/image-20241102185320189.png | Bin 759334 -> 0 bytes img/000.png | Bin 0 -> 10085 bytes img/001.png | Bin 0 -> 144005 bytes img/002.png | Bin 0 -> 110549 bytes Dockerfile => old/Dockerfile | 0 old/README.md | 3 + docker-compose.yml => old/docker-compose.yml | 2 +- 9 files changed, 156 insertions(+), 29 deletions(-) create mode 100644 CHANGELOG.md delete mode 100644 assets/image-20241102185320189.png create mode 100644 img/000.png create mode 100644 img/001.png create mode 100644 img/002.png rename Dockerfile => old/Dockerfile (100%) create mode 100644 old/README.md rename docker-compose.yml => old/docker-compose.yml (94%) diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..722122a --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,41 @@ +## 1.1.0 + +更新内容: + +- [重要] 前端大重构和优化 @Ar3h +- [重要] 提供 `docker` 一键启动命令 @Ar3h @4ra1n +- [重要] 提供了从 `jar` 文件加载的简易插件系统 @Ar3h +- [重要] 新增 `h2 without js` 全版本通杀链 @unam4 +- [功能] 基于 `spring security` 的登录功能 @springkill @4ra1n +- [功能] 新增两种 `equals` 和 `c3p0 jndi/jdbc` 链 @unam4 +- [功能] `hessian` 新增 `groovy` 利用链 @Ar3h +- [功能] 字节码可添加 `main` 静态入口函数 @Ar3h +- [BUG] 无法正确显示 `favicon.ico` 图标问题 @xcxmiku +- [优化] `server` 探测新增 `netty` 框架探测 @Ar3h +- [优化] 高版本 `Oralce JDK` 可以使用 `BCEL` 相关 @4ra1n +- [优化] 优化某些仅 `unix` 类型的 `gadget` 提示信息 @4ra1n +- [优化] 格式化输出日志,为日志附加颜色 @springkill +- [优化] 启动时检测 `java` 版本给出警告 @4ra1n +- [优化] 优化拦截器逻辑 @ssrsec +- [优化] 优化 `base64` 通用性 @ssrsec +- [文档] 编写新版本使用文档 @ssrsec + +感谢以下用户的贡献: + +- Ar3h (https://github.com/Ar3h) +- 某匿名安全研究师傅 +- unam4 (https://github.com/unam4) +- 小晨曦 (https://github.com/xcxmiku) +- 4ra1n (https://github.com/4ra1n) +- springkill (https://github.com/springkill) +- 说书人 (https://github.com/ssrsec) + +使用 `java -jar java-chains.jar` 即可启动(仅支持 `java 8` 环境) + +推荐使用 `docker` 一键启动(请参考 `README` 页面) + +其中 `chains-config.zip` 是补充插件,解压后放在 `jar` 同级目录即可 + +## 1.0.0 + +初始开源版本 \ No newline at end of file diff --git a/README.md b/README.md index 78616a2..3cc9331 100644 --- a/README.md +++ b/README.md @@ -1,54 +1,137 @@ -# Web-Chains +# web-chains -详细食用文档:https://www.yuque.com/shenjingwa-leuvd/wpqdhf/eekyvau9fcblzzt0?singleDoc# +![](https://img.shields.io/github/downloads/java-chains/web-chains/total) +![](https://img.shields.io/github/v/release/java-chains/web-chains) +`web-chains` 项目,又名 `java-chains` 项目,由 `Ar3h` 师傅主导开发,漏洞百出和代码审计星球支持 +
n-Tp`xur(A){wGt^Fe#gEG%-Vd+yk0XtPPUa7azZuLq)!UN3l4O_1Jjp{GAEc
z=4qayF7yIH770q`K2|ox#iwMXlIZMCdW-JW!f#ylYbAL_yg>0Xv-7WUlZ6h4+0JB9
zD28hPWCD{$l5~e @+V02n!mEDky!?BP>)_ FvkO)I$b&3DtXC 52gyIyRHJEL7O9XqZ|0{zrE38>fU*{K0?*U}hoQ<2yAv-|CpVUbX`sYR#Q&
z9Q#c5rSlAis-4T;pKE9ia-uHVb;-uq#g>e qEvX@~zUhCa0geu5(7PPN~xZ5R$u&{y(pNW+*8k^FvMJGrEso+vqDGo;&6f|%j
zA*a2_IF0G{B|4HCf0H1!#Stamt2HLpB1W~5_SMIwEnV&sc|-Ae!JG8AxN-|=&*K51
z+msL94uvEsrTKR%tIEX@X6=eEn%L2))KqF?D;IMO2P{Sqr`$4Nv8}xSJJG%s0!~m?
zE3{87ncwfdZ*yCV*qNh=tZ;7XTdWkGhO$e%hNA7RN%irbHNkl#I*|(S(9KK&I$_Pg
zuQeW9Y%TLo+vie$LjzDrA7al#`gpsqp-O&63iZ4#vk~5LZij}}tI=uC>z if@=h*HKqh&NU3ISe_KQ{CaroSojGqb
z%|Lr#OZvn7Y9}_u@`lrEfMGe#gGdI@LS!)ZWaLD5Sz<`~E$qr9cLGUwH?jCNyKWg3
z(dAgjNhSB2)gT{jz(To+?T(+teW(tu?A&107}B$R|E1lKTYrz{3NVV?@bfaOVb`ue
z4(shrFxQR{hXeK$J^2)?TbBGF)O_!`7xB<3!A!)+70j&>Vns4`D+=eQb+WDG;T2L`
zb6)!Q;+l}A5%lvDDhkonj3`LROlk8HnU}aIhr8G5BA{`^{-`K~(gs%MW{!W}MP_PC
zGC@V3LCaPt!k~Qv%6Euu1wtDNl DZM!wHKIxr_A!&=CJ|vlHP$Pv=2cI}680qM2B&Y@
zXoY+rg5xVHSip=9H~p=F4++D$x|UXZ8Z7csgCc~A^jA!{23eHJ@7B3ut?pEgL(6xb
z113 !aaW_)aI9SvVA~f@
z<1BfzsaHOmTxdB`Z0K;r7e8)c9avJssE{L%MW9hM`jhtSfc$uzp
z73<%Lrrc!Ml;nL6UN&P0*6tJ*KmKYFRg_|jiyW<4TCX*AM@3oo2|gbbwgqsq1cmOe
z)(zeWkGgUN1-qYwJpSoLM$ACAGK-R2WcfX`3vEVeGtzWLVw^GajxPwQU!BMD<(M1y
ze80CFY!eA}>2+PbLZ)uw62z!8|1~qVij3r8k$i{IuF=+1(YC!8Hkmnw%S@6xwP~(6
z5@QUZEbPW#k(YRmzyTG8#XI3y910V!bn*7+-=I;NmurqEv{{ysu9*p~R-g9m0Bn3Y
zcAusQKGbQ;_ptQ(uQzE{oW#HxLp7w|5U+WNu7qvP2>g0d5?8~ox!ExF$O(i7GP)}p
z!mcz^pMmbR;ula?)?Okr%E{VI>f>)8#c_n2W|9i0r~;Nud=D1Nd-8sVKLS~&JsC2=}0b85O8
z$(jhBP^gq|6@rt;#g%u)50awOo{=dv00#=bW~K;6S43B>z7Dn+?2f;uTq!1itdFxr
zi|s^Nos~g*;l*d|k>F1EBJ*ey769^FkDYsuCZHD4fDoq6l_p+Vk8A|C+NgfemPzT7
zY5E}lNqM#1(a7P{nR{CBf!GOr-T2e`Vs|DpU%lOa;m1^&3jN%OG-U%bAisbYfX+nj
zb?jA&7#E%9Fn8@MI)obDk3fBqJBUQ=;Wz?~1>i1^LFuB8WV=0{crkRjlWkQbQR<;7
zlCKGjC@~ImN7hfvVjo_i8DgV&%56ZXHuvEWs53hJumn2<$MZ`UND#3nZbBfjOiytC
zjbBJJFR|y^QhtkVO!|jsMe_~xIgWKfE=}z1pBg8NC3BkFg*InL0FB*a1qlYEPh;Tf
zD^@0ZsJY1e3)<-ckbxmlcpRZ&3jc=9nm16Kt^@@Y?IDdVS>xn7Q+*RX4sw|E6QgLr
z2ILLy1lgaYc@CTnYzF_P8$ZJhA@P&39(%tAoTDVqCHfKx{EYN_hC`~03-Ly6|D}1!
zKZlo!TsaxoL?}|-96J|5KCLZ!%-y^d<$=qus^`%5OXxHaVHBmi^YX-3gvS5k+1J(X
z^}*`X{_G#pp%dHV{5