靶场测试环境

create database shoot;
USE `shoot`;
CREATE TABLE IF NOT EXISTS `users`(
 `id` INT UNSIGNED AUTO_INCREMENT,
 `username` VARCHAR(255) NOT NULL,
 `password` VARCHAR(255) NOT NULL,
 PRIMARY KEY (`id`)
)ENGINE=InnoDB DEFAULT CHARSET=utf8;
INSERT INTO `users` VALUES (1, 'admin', 'admin123');
INSERT INTO `users` VALUES (2, 'joychou', 'joychou123');

使用的实战环境

Issus

更新历史

wJa

wJa的工作原理

cheetah脚本语言

wJa使用

wJa UI介绍

wJa反编译的代码比较

wJa调试jar包

Agent方法的IAST跟踪

StartRecordFun
无参数
返回值:无
StopRecordFun
参数1:要查询的起始类名+方法名
返回值:执行流数组

案例1:扫描SQL注入

function getSpringAnnotationValue(an){
	anSize = GetArrayNum(an);
	i = 0;
	flag = 0;
	while(i < anSize){
		if(GetAnnotationName(an[i]) == "org/springframework/web/bind/annotation/RequestMapping"){
			allValue = GetAnnotationArgListValue(an[i],"value");
			return allValue[0];
		}
		if(GetAnnotationName(an[i]) == "org/springframework/web/bind/annotation/GetMapping"){
			allValue = GetAnnotationArgListValue(an[i],"value");
			return allValue[0];
		}
		if(GetAnnotationName(an[i]) == "org/springframework/web/bind/annotation/PostMapping"){
			allValue = GetAnnotationArgListValue(an[i],"value");
			return allValue[0];
		}
		if(GetAnnotationName(an[i]) == "org/springframework/web/bind/annotation/RequestParam"){
			allValue = GetAnnotationArgSingValue(an[i],"value");
			return allValue;
		}
		if(GetAnnotationName(an[i]) == "org/springframework/web/bind/annotation/RestController"){
			flag = 1;
		}
		i = ToInt(i + 1);
	}
	if(flag == 1){
		return "/";
	}
	return "";
}
function GetAllSpringApiClasses(){
	array res;
	allClass = GetAllClassName();
	size = GetArrayNum(allClass);
	i = 0;
	while(i < size){
		an = GetClassAnnotation(allClass[i]);
		p = getSpringAnnotationValue(an);
		if(p != ""){
			ArrayAddEle(res,allClass[i]);
		}
		i = ToInt(i + 1);
	}
	return res;
}

function SQLTrack(className){
	an = GetClassAnnotation(className);
	classPath = baseUrl.getSpringAnnotationValue(an);
	methods = GetAllMethodName(className);
	size = GetArrayNum(methods);
	i = 0;
	while(i < size){
		argCnt = GetMethodArgCnt(className,methods[i]);
		j = 0;
		while(j < argCnt){
			if(methods[i] != "<init>"){trackSQL(className,methods[i],classPath,j);}
			j = ToInt(j+1);
		}
		i = ToInt(i+1);
	}
	return 0;
}

function trackSQL(className,methodName,url,argIndex){
	array allNode;
	allNode = TrackVarIntoFun(className,methodName,argIndex,"java/sql/Statement","executeQuery",0,1);
	size = GetArrayNum(allNode);
	if(ToInt(size-1) < 0){return 0;}
	i = 0;
	print(methodName.":SQL注入 白盒测试调用链跟踪:");
	cc = 7;
	cs = 1;
	while(i < size){
		sentence = GetJavaSentence(allNode[i]);
		noSan = filter(sentence,GetTrackName(allNode[i]));
		if(noSan == 0){cc = 5;cs = 5;}
		if(i == ToInt((size-1))){
			if(cc != 5){cs = 2;cc = 3;}
		}else{}
		if(noSan == 0){
			printcolor("[-]",6);printcolor("想办法绕过此类:",4);
		}else{
			printcolor("[+]",1);
		}
		printcolor(GetClassName(GetNodeClassName(allNode[i]))." ",cc);
		printcolor(sentence.StrRN(),cs);
		i = ToInt(i+1);
	}
	if(cc != 5){
		printcolor("白盒测试发现此调用链可能存在漏洞,生成测试链接进行黑盒测试".StrRN(),7);
		an = GetClassMethodAnnotation(className,methodName);
		var argName;
		try{
			arg_an = GetClassMethodArgAnnotation(className,methodName,0);
			argName = getSpringAnnotationValue(arg_an);
		}catch(){
			argName = GetClassMethodArgName(className,methodName,0);
		}
		if(argName != ""){
			api = url.getSpringAnnotationValue(an)."?".argName."=Wker";
			StartRecordFun();
			if(judgeSQLI(api) == 1){
				printcolor("[+]生成测试链接:".api." 测试存在SQL注入漏洞!".StrRN(),3);
			}else{
				printcolor("[-]生成测试链接:".api." 测试不存在SQL注入漏洞!请自行测试。".StrRN(),5);
			}
			print("IAST真实调用链:",StopRecordFun(className.".".methodName));
		}else{
			printcolor("测试链接生成失败,error:未找到参数入口!".StrRN(),5);
		}
	}
	
	return 0;
}

参数1:起始类
参数2:起始方法
参数3:起始方法参数下标
参数4:目标方法的类
参数5:目标方法
参数6:目标方法的参数下标
参数7:0:一直跟踪1:只跟踪到sink
返回值:执行流node数组

#define filter1=String.valueOf(.*?
#define filter2=Integer.valueOf(.*?
#define filter3=Long.valueOf(.*?
function filter(sentence,trackName){
	ap = trackName.".*?)";
	a = StrRe(sentence,filter1.ap);
	if(GetArrayNum(a) != 0){return 0;}
	a = StrRe(sentence,filter2.ap);
	if(GetArrayNum(a) != 0){return 0;}
	a = StrRe(sentence,filter3.ap);
	if(GetArrayNum(a) != 0){return 0;}
	return 1;
}

function judgeSQLI(api){
	res = HttpGet(api,cookie);
	res1 = HttpGet(api."%27%20or%201=1--+",cookie);
	if(GetStrLength(res1[0]) != GetStrLength(res[0])){
		res2 = HttpGet(api."%27%20or%202=1--+",cookie);
		if(GetStrLength(res2[0]) == GetStrLength(res[0])){
			return 1;
		}
	}
	return 0;
}

案例2:获取危险库

案例3:fastjson检测

function getDnsLogDomain(){
 SetGlobalValue("dnslogCookie","User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.87 Safari/537.36".StrRN()."Cookie: PHPSESSID=wJa;");
 res = HttpGet("http://www.dnslog.cn/getdomain.php?t=0.02695357778962082",dnslogCookie);
 dns = StrSplit(res[0],StrRN());
 return dns[0];
}
function getDnsLogRecord(){
 res = HttpGet("http://www.dnslog.cn/getrecords.php?t=0.29442376629799494",dnslogCookie);
 rec = StrSplit(res[0],StrRN());
 return rec[0];
}

function judgeFastjson(api){
	domain = getDnsLogDomain();
	res1 = HttpGet(api."%7B%22%40type%22%3A%22java.net.Inet4Address%22%2C%22val%22%3A%22".domain."%22%7D",cookie);
	Sleep(1000);
	if(getDnsLogRecord() != "[]"){
		return 1;
	}
	return 0;
}

案例4:mybatis类型的SQLI

获取所有映射的xml文件名称

function GetConfigeFileMap(path){
 ap = GetFileContent(path);
 allPro = StrSplit(ap,StrRN());
 i = 0;
 size = GetArrayNum(allPro);
 res = GetHashMap();
 while(i < size){
 cur = allPro[i];
 index = StrFindStr(cur,"=",0);
 if(index == "-1"){
 	i = ToInt(i+1);
 	continue;
 }
 key = StrSubString(cur,0,index);
 value = StrSubString(cur,ToInt(index+1),GetStrLength(cur));
 SetHashMapValue(res,key,value);
 i = ToInt(i+1);
 }
 return res;
}
function GetApplicationPro(){
	return GetConfigeFileMap("BOOT-INF/classes/application.properties");
}
function getAllMapperXmlFileNames(){
	pro = GetApplicationPro();
	v = GetHashMapValue(pro,"mybatis-plus.mapper-locations");
	index = StrFindStr(v,":",0);
	path = StrSubString(v,ToInt(index+1),GetStrLength(v));
	return MatchesFileName(GetFilePath(path));
}

解析xml文件得到SQL类和方法

function getClassMethodName(root){
	array res;
	childs = GetElementChilds(root);
	childSize = GetArrayNum(childs);
	i = 0;
	while(i < childSize){
		if(GetElementName(childs[i]) == "select"){
			attributes = GetElementAttributes(childs[i]);
			attributeSize = GetArrayNum(attributes);
			j = 0;
			while(j < attributeSize){
				if(GetAttributeName(attributes[j]) == "id"){
					ArrayAddEle(res,GetAttributeText(attributes[j]));
				}
				j = ToInt(j + 1);
			}
		}
		i = ToInt(i + 1);
	}
	return res;
}
function getClassName(root){
	attributes = GetElementAttributes(root);
	attributeSize = GetArrayNum(attributes);
	j = 0;
	while(j < attributeSize){
		if(GetAttributeName(attributes[j]) == "namespace"){
			return GetAttributeText(attributes[j]);
		}
		j = ToInt(j + 1);
	}
	return "";
}

function MybatisSQLTrack(className){
 an = GetClassAnnotation(className);
 classPath = baseUrl.getSpringAnnotationValue(an);
 methods = GetAllMethodName(className);
 size = GetArrayNum(methods);
 mybatisXmls = getAllMapperXmlFileNames();
 xmlSize = GetArrayNum(mybatisXmls);
 xmlIndex = 0;
 while(xmlIndex < xmlSize){
 root = GetXMLRoot(GetFileContent(mybatisXmls[xmlIndex]));
 mybatisClassName = StrReplace(getClassName(root),"\.","/");
 mybatisMethodNames = getClassMethodName(root);
 mybatisMethodNameSize = GetArrayNum(mybatisMethodNames);
 mybatisMethodIndex = 0;
 while(mybatisMethodIndex < mybatisMethodNameSize){
 curMybatisMethodName = mybatisMethodNames[mybatisMethodIndex];
 //mybatis注入
 i = 0;
 while(i < size){
 argCnt = GetMethodArgCnt(className,methods[i]);
 j = 0;
 while(j < argCnt){
 if(methods[i] != "<init>"){
 trackMybatisSQL(className,methods[i],classPath,j,mybatisClassName,curMybatisMethodName);
 }
 j = ToInt(j+1);
 }
 i = ToInt(i+1);
 }
 mybatisMethodIndex = ToInt(mybatisMethodIndex + 1);
 }
 xmlIndex = ToInt(xmlIndex + 1);
 }
	return 0;
}

目前自带的漏洞检测脚本

wJa的一些细节

wJa Link