PageSourceSearch

https://zjackky.github.io/post/develop-codescan-zwcz53.html

html zjackky.github.io collected 2026-10-03 10:15:06 UTC 42,805 bytes, 846 lines download raw bytes

1
2
3<!DOCTYPE html>
4<html lang="zh-CN" data-default-color-scheme=auto>
5
6
7
8<head>
9  <meta charset="UTF-8">
10  <link rel="apple-touch-icon" sizes="76x76" href="/img/head.jpg">
11  <link rel="icon" href="/img/head.jpg">
12  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0, shrink-to-fit=no">
13  <meta http-equiv="x-ua-compatible" content="ie=edge">
14  
15  <meta name="theme-color" content="#2f4154">
16  <meta name="author" content="Zjacky">
17  <meta name="keywords" content="Zjacky">
18  
19    <meta name="description" content="开发 - CodeScan前言这里是详细解释下CodeScan的用法,之前偏向于快速的代码审计,于是就写了一个这种快速匹配Sink点的工具,省的每次点点点搜搜索了,Python属实不优雅,就拿go写了一下,难度不大,练练手的项目,审计也不能一成不变的死磕,利用一些辅助工具会事半功倍,以下为完全详解,有任何问题和Bug可以Github上提Issue或者在Blog的关于页面找我的联系方式进行私聊,对师">
20<meta property="og:type" content="article">
21<meta property="og:title" content="开发 - CodeScan">
22<meta property="og:url" content="https://zjackky.github.io/post/develop-codescan-zwcz53.html">
23<meta property="og:site_name" content="Zjacky Blog">
24<meta property="og:description" content="开发 - CodeScan前言这里是详细解释下CodeScan的用法,之前偏向于快速的代码审计,于是就写了一个这种快速匹配Sink点的工具,省的每次点点点搜搜索了,Python属实不优雅,就拿go写了一下,难度不大,练练手的项目,审计也不能一成不变的死磕,利用一些辅助工具会事半功倍,以下为完全详解,有任何问题和Bug可以Github上提Issue或者在Blog的关于页面找我的联系方式进行私聊,对师">
25<meta property="og:locale" content="zh_CN">
26<meta property="og:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240928235812-5wlbnbb.png">
27<meta property="og:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240929002903-ypqa197.png">
28<meta property="og:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240929003143-7v37o9w.png">
29<meta property="og:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240929124102-qjfancc.png">
30<meta property="og:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406155237-imb68qu.png">
31<meta property="og:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406155756-ob60ahp.png">
32<meta property="og:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406155950-rnf1w3w.png">
33<meta property="og:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406160610-h206usc.png">
34<meta property="og:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406160326-n6xok99.png">
35<meta property="og:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406160725-a19hq1m.png">
36<meta property="og:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406161504-eys6pkt.png">
37<meta property="og:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406161613-ujiovc5.png">
38<meta property="og:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406161722-27awoxu.png">
39<meta property="og:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406161933-tsbc5fw.png">
40<meta property="article:published_time" content="2024-09-28T15:32:13.000Z">
41<meta property="article:modified_time" content="2024-09-29T04:19:40.000Z">
42<meta property="article:author" content="Zjacky">
43<meta property="article:tag" content="Zjacky">
44<meta name="twitter:card" content="summary_large_image">
45<meta name="twitter:image" content="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240928235812-5wlbnbb.png">
46  
47  
48    <meta name="referrer" content="no-referrer-when-downgrade">
49  
50  
51  <title>开发 - CodeScan - Zjacky Blog</title>
52
53  <link  rel="stylesheet" href="https://lib.baomitu.com/twitter-bootstrap/4.6.1/css/bootstrap.min.css" />
54
55
56
57  <link  rel="stylesheet" href="https://lib.baomitu.com/github-markdown-css/4.0.0/github-markdown.min.css" />
58
59  <link  rel="stylesheet" href="https://lib.baomitu.com/hint.css/2.7.0/hint.min.css" />
60
61  <link  rel="stylesheet" href="https://lib.baomitu.com/fancybox/3.5.7/jquery.fancybox.min.css" />
62
63
64
65<!-- 主题依赖的图标库,不要自行修改 -->
66<!-- Do not modify the link that theme dependent icons -->
67
68<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_hj8rtnfg7um.css">
69
70
71
72<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_lbnruvf0jn.css">
73
74
75<link  rel="stylesheet" href="/css/main.css" />
76
77
78  <link id="highlight-css" rel="stylesheet" href="/css/highlight.css" />
79  
80    <link id="highlight-css-dark" rel="stylesheet" href="/css/highlight-dark.css" />
81  
82
83
84
85
86  
86<script id="fluid-configs">
87    var Fluid = window.Fluid || {};
88    Fluid.ctx = Object.assign({}, Fluid.ctx)
89    var CONFIG = {"hostname":"zjackky.github.io","root":"/","version":"1.9.7","typing":{"enable":true,"typeSpeed":70,"cursorChar":"$","loop":false,"scope":[]},"anchorjs":{"enable":true,"element":"h1,h2,h3,h4,h5,h6","placement":"left","visible":"hover","icon":"❡"},"progressbar":{"enable":true,"height_px":3,"color":"#29d","options":{"showSpinner":false,"trickleSpeed":100}},"code_language":{"enable":true,"default":"TEXT"},"copy_btn":true,"image_caption":{"enable":true},"image_zoom":{"enable":true,"img_url_replace":["",""]},"toc":{"enable":true,"placement":"left","headingSelector":"h1,h2,h3,h4,h5,h6","collapseDepth":5},"lazyload":{"enable":true,"loading_img":"/img/loading.gif","onlypost":false,"offset_factor":2},"web_analytics":{"enable":true,"follow_dnt":true,"baidu":null,"google":{"measurement_id":null},"tencent":{"sid":null,"cid":null},"woyaola":null,"cnzz":null,"leancloud":{"app_id":null,"app_key":null,"server_url":null,"path":"window.location.pathname","ignore_local":false}},"search_path":"/local-search.xml","include_content_in_search":true};
90
91    if (CONFIG.web_analytics.follow_dnt) {
92      var dntVal = navigator.doNotTrack || window.doNotTrack || navigator.msDoNotTrack;
93      Fluid.ctx.dnt = dntVal && (dntVal.startsWith('1') || dntVal.startsWith('yes') || dntVal.startsWith('on'));
94    }
95  </script>
95
96  
96<script  src="/js/utils.js" ></script>
96
97  
97<script  src="/js/color-schema.js" ></script>
97
98  
99
100  
101
102  
103    <!-- Google tag (gtag.js) -->
104    
104<script async>
105      if (!Fluid.ctx.dnt) {
106        Fluid.utils.createScript("https://www.googletagmanager.com/gtag/js?id=", function() {
107          window.dataLayer = window.dataLayer || [];
108          function gtag() {
109            dataLayer.push(arguments);
110          }
111          gtag('js', new Date());
112          gtag('config', '');
113        });
114      }
115    </script>
115
116  
117
118  
119
120  
121
122  
123
124  
125
126
127
128  
129<meta name="generator" content="Hexo 7.1.1"></head>
130
131
132<body>
133  
134
135  <header>
136    
137
138<div class="header-inner" style="height: 70vh;">
139  <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
140  <div class="container">
141    <a class="navbar-brand" href="/">
142      <strong>Zjacky&#39;s Blog</strong>
143    </a>
144
145    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
146            data-target="#navbarSupportedContent"
147            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
148      <div class="animated-icon"><span></span><span></span><span></span></div>
149    </button>
150
151    <!-- Collapsible content -->
152    <div class="collapse navbar-collapse" id="navbarSupportedContent">
153      <ul class="navbar-nav ml-auto text-center">
154        
155          
156          
157          
158          
159            <li class="nav-item">
160              <a class="nav-link" href="/" target="_self">
161                <i class="iconfont icon-home-fill"></i>
162                <span>首页</span>
163              </a>
164            </li>
165          
166        
167          
168          
169          
170          
171            <li class="nav-item">
172              <a class="nav-link" href="/archives/" target="_self">
173                <i class="iconfont icon-archive-fill"></i>
174                <span>归档</span>
175              </a>
176            </li>
177          
178        
179          
180          
181          
182          
183            <li class="nav-item">
184              <a class="nav-link" href="/categories/" target="_self">
185                <i class="iconfont icon-category-fill"></i>
186                <span>分类</span>
187              </a>
188            </li>
189          
190        
191          
192          
193          
194          
195            <li class="nav-item">
196              <a class="nav-link" href="/tags/" target="_self">
197                <i class="iconfont icon-tags-fill"></i>
198                <span>标签</span>
199              </a>
200            </li>
201          
202        
203          
204          
205          
206          
207            <li class="nav-item">
208              <a class="nav-link" href="/about/" target="_self">
209                <i class="iconfont icon-user-fill"></i>
210                <span>关于</span>
211              </a>
212            </li>
213          
214        
215          
216          
217          
218          
219            <li class="nav-item">
220              <a class="nav-link" href="/links/" target="_self">
221                <i class="iconfont icon-link-fill"></i>
222                <span>友链</span>
223              </a>
224            </li>
225          
226        
227        
228          <li class="nav-item" id="search-btn">
229            <a class="nav-link" target="_self" href="javascript:;" data-toggle="modal" data-target="#modalSearch" aria-label="Search">
230              <i class="iconfont icon-search"></i>
231            </a>
232          </li>
233          
234        
235        
236          <li class="nav-item" id="color-toggle-btn">
237            <a class="nav-link" target="_self" href="javascript:;" aria-label="Color Toggle">
238              <i class="iconfont icon-dark" id="color-toggle-icon"></i>
239            </a>
240          </li>
241        
242      </ul>
243    </div>
244  </div>
245</nav>
246
247  
248
249<div id="banner" class="banner" parallax=true
250     style="background: url('/img/3.jpg') no-repeat center center; background-size: cover;">
251  <div class="full-bg-img">
252    <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
253      <div class="banner-text text-center fade-in-up">
254        <div class="h2">
255          
256            <span id="subtitle" data-typed-text="开发 - CodeScan"></span>
257          
258        </div>
259
260        
261          
262  <div class="mt-3">
263    
264    
265      <span class="post-meta">
266        <i class="iconfont icon-date-fill" aria-hidden="true"></i>
267        <time datetime="2024-09-28 23:32" pubdate>
268          2024年9月28日 晚上
269        </time>
270      </span>
271    
272  </div>
273
274  <div class="mt-1">
275    
276      <span class="post-meta mr-2">
277        <i class="iconfont icon-chart"></i>
278        
279          1.6k 字
280        
281      </span>
282    
283
284    
285      <span class="post-meta mr-2">
286        <i class="iconfont icon-clock-fill"></i>
287        
288        
289        
290          14 分钟
291        
292      </span>
293    
294
295    
296    
297      
298        <span id="busuanzi_container_page_pv" style="display: none">
299          <i class="iconfont icon-eye" aria-hidden="true"></i>
300          <span id="busuanzi_value_page_pv"></span> 次
301        </span>
302        
303      
304    
305  </div>
306
307
308        
309      </div>
310
311      
312    </div>
313  </div>
314</div>
315
316</div>
317
318  </header>
319
320  <main>
321    
322      
323
324<div class="container-fluid nopadding-x">
325  <div class="row nomargin-x">
326    <div class="side-col d-none d-lg-block col-lg-2">
327      
328  <aside class="sidebar" style="padding-left: 2rem; margin-right: -1rem">
329    <div id="toc">
330  <p class="toc-header">
331    <i class="iconfont icon-list"></i>
332    <span>目录</span>
333  </p>
334  <div class="toc-body" id="toc-body"></div>
335</div>
336
337
338
339  </aside>
340
341
342    </div>
343
344    <div class="col-lg-8 nopadding-x-md">
345      <div class="container nopadding-x-md" id="board-ctn">
346        <div id="board">
347          <article class="post-content mx-auto">
348            <h1 id="seo-header">开发 - CodeScan</h1>
349            
350            
351              <div class="markdown-body">
352                
353                <h1 id="开发-CodeScan"><a href="#开发-CodeScan" class="headerlink" title="开发 - CodeScan"></a>开发 - CodeScan</h1><h1 id="前言"><a href="#前言" class="headerlink" title="前言"></a>前言</h1><p>这里是详细解释下CodeScan的用法,之前偏向于快速的代码审计,于是就写了一个这种快速匹配Sink点的工具,省的每次点点点搜搜索了,Python属实不优雅,就拿go写了一下,难度不大,练练手的项目,审计也不能一成不变的死磕,利用一些辅助工具会事半功倍,以下为完全详解,有任何问题和Bug可以Github上提Issue或者在Blog的关于页面找我的联系方式进行私聊,对师傅们有帮助的话可以点点Stars捏。</p>
354<p>‍</p>
355<h1 id="CodeScan"><a href="#CodeScan" class="headerlink" title="CodeScan"></a>CodeScan</h1><h2 id="工具概述"><a href="#工具概述" class="headerlink" title="工具概述"></a>工具概述</h2><p>该工具目的为对大多数不完整的代码以及依赖快速进行Sink点匹配来帮助红队完成快速代码审计,开发该工具的初衷是以<code>Sink</code>​到<code>Source</code>​的思路来开发,为了将所有可疑的Sink点匹配出来并且凭借第六感进行快速漏洞挖掘,并且该工具开发可扩展性强,成本极低,目前工具支持的语言有PHP,Java(JSP)</p>
356<p>‍</p>
357<h2 id="编译"><a href="#编译" class="headerlink" title="编译"></a>编译</h2><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><code class="hljs bash">./build.sh<br><br><span class="hljs-comment"># 会生成所有版本在releases下</span><br></code></pre></td></tr></table></figure>
358
359<p>‍</p>
360<h2 id="功能"><a href="#功能" class="headerlink" title="功能"></a>功能</h2><ol>
361<li><p>框架识别</p>
362</li>
363<li><p>涵盖大部分漏洞的Sink点的匹配(如图)</p>
364<p> <img src="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240928235812-5wlbnbb.png" srcset="/img/loading.gif" lazyload alt="image">​</p>
365</li>
366<li><p>可自定义定制化修改黑白名单内容</p>
367</li>
368<li><p>多模块化多语言化代码审计</p>
369</li>
370<li><p>进行融于鉴权代码的快速匹配抓取</p>
371</li>
372<li><p>根据Jar进行静态分析(默认分析)</p>
373</li>
374</ol>
375<ul>
376<li>mysqlconnect–&gt;jdbc</li>
377<li>Xstream –&gt; xml&#x2F;json</li>
378</ul>
379<p>‍</p>
380<h2 id="使用">
380<a href="#使用" class="headerlink" title="使用"></a>使用</h2><p>‍</p>
381<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br></pre></td><td class="code"><pre><code class="hljs bash">Usage of ./CodeScan_darwin_arm64:<br>  -L string<br>        审计语言<br>  -d string<br>        要扫描的目录<br>  -h string<br>        使用帮助<br>  -lb string<br>        行黑名单<br>  -m string<br>        过滤的字符串<br>  -pb string<br>        路径黑名单<br>  -r string<br>        RCE规则<br>  -u string<br>        文件上传规则<br><br><br>Example:<br>	CodeScan_windows_amd64.exe -L java -d ./net<br>	CodeScan_windows_amd64.exe -L php -d ./net<br>	CodeScan_windows_amd64.exe -d ./net -m <span class="hljs-string">&quot;CheckSession.jsp&quot;</span><br></code></pre></td></tr></table></figure>
382
383<p>‍</p>
384<h2 id="高级用法"><a href="#高级用法" class="headerlink" title="高级用法"></a>高级用法</h2><p><code>以下均以Java作为示例</code>​</p>
385<h3 id="高扩展性"><a href="#高扩展性" class="headerlink" title="高扩展性"></a>高扩展性</h3><p>很简单的自定义,如果需要自定义一些匹配规则,首先可以在这里加入</p>
386<p><img src="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240929002903-ypqa197.png" srcset="/img/loading.gif" lazyload alt="image">​</p>
387<p>‍</p>
388<p>其次如果需要新增漏洞类型,只需要三步(这里以Sql为例)</p>
389<ol>
390<li>新建SQL目录</li>
391<li>定义一个方法叫 SqlCheck</li>
392<li>写一个sqlcheck.txt(生成的文件名) + 你自定义的规则</li>
393<li>最后在这里加入包名+方法名即可</li>
394</ol>
395<p><img src="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240929003143-7v37o9w.png" srcset="/img/loading.gif" lazyload alt="image">​</p>
396<p>‍</p>
397<figure class="highlight go"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><code class="hljs go"><span class="hljs-keyword">package</span> SqlTest<br><br><span class="hljs-keyword">import</span> (<br>	<span class="hljs-string">&quot;CodeScan/FindFile&quot;</span><br>	<span class="hljs-string">&quot;fmt&quot;</span><br>)<br><br><span class="hljs-function"><span class="hljs-keyword">func</span> <span class="hljs-title">SqlCheck</span><span class="hljs-params">(dir <span class="hljs-type">string</span>)</span></span> &#123;<br>	FindFile.FindFileByJava(dir, <span class="hljs-string">&quot;fastjson.txt&quot;</span>, []<span class="hljs-type">string</span>&#123;<span class="hljs-string">&quot;.parseObject(&quot;</span>&#125;)<br>	fmt.Println(<span class="hljs-string">&quot;SqlCheck分析完成&quot;</span>)<br><br>&#125;<br><br></code></pre></td></tr></table></figure>
398
399<p>‍</p>
400<h3 id="扫描位置"><a href="#扫描位置" class="headerlink" title="扫描位置"></a>扫描位置</h3><p>在打一些闭源代码的时候经常就一个Jar或者Class,反编译的时候会把依赖进行一起反编译,所以为了避免扫描一些依赖的误报,在工具中自带的黑名单中会过滤掉如下黑名单的包名ï¼
400Œéœ€è¦è‡ªå®šä¹‰çš„æ—¶å€™å¯è‡ªè¡Œä¿®æ”¹ï¼Œä½ç½®åœ¨<code>CommonVul/Rule/MatchPathRule.go</code>​</p>
401<figure class="highlight go"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><code class="hljs go"><span class="hljs-keyword">var</span> PathBlackJava = []<span class="hljs-type">string</span>&#123;<br>	<span class="hljs-string">&quot;apache&quot;</span>, <span class="hljs-string">&quot;lombok&quot;</span>, <span class="hljs-string">&quot;microsoft&quot;</span>, <span class="hljs-string">&quot;solr&quot;</span>,<br>	<span class="hljs-string">&quot;amazonaws&quot;</span>, <span class="hljs-string">&quot;c3p0&quot;</span>, <span class="hljs-string">&quot;jodd&quot;</span>, <span class="hljs-string">&quot;afterturn&quot;</span>, <span class="hljs-string">&quot;hutool&quot;</span>,<br>	<span class="hljs-string">&quot;javassist&quot;</span>, <span class="hljs-string">&quot;alibaba&quot;</span>, <span class="hljs-string">&quot;aliyuncs&quot;</span>, <span class="hljs-string">&quot;javax&quot;</span>, <span class="hljs-string">&quot;jackson&quot;</span>,<br>	<span class="hljs-string">&quot;bytebuddy&quot;</span>, <span class="hljs-string">&quot;baomidou&quot;</span>, <span class="hljs-string">&quot;google&quot;</span>, <span class="hljs-string">&quot;netty&quot;</span>, <span class="hljs-string">&quot;redis&quot;</span>, <span class="hljs-string">&quot;mysql&quot;</span>,<br>	<span class="hljs-string">&quot;logback&quot;</span>, <span class="hljs-string">&quot;ognl&quot;</span>, <span class="hljs-string">&quot;oracle&quot;</span>, <span class="hljs-string">&quot;sun&quot;</span>, <span class="hljs-string">&quot;junit&quot;</span>, <span class="hljs-string">&quot;reactor&quot;</span>, <span class="hljs-string">&quot;github&quot;</span>,<br>	<span class="hljs-string">&quot;mchange&quot;</span>, <span class="hljs-string">&quot;taobao&quot;</span>, <span class="hljs-string">&quot;nimbusds&quot;</span>, <span class="hljs-string">&quot;opensymphony&quot;</span>, <span class="hljs-string">&quot;freemarker&quot;</span>, <span class="hljs-string">&quot;java&quot;</span>, <span class="hljs-string">&quot;apiguardian&quot;</span>, <span class="hljs-string">&quot;hibernate&quot;</span>, <span class="hljs-string">&quot;javassist&quot;</span>, <span class="hljs-string">&quot;jboss&quot;</span>, <span class="hljs-string">&quot;junit&quot;</span>, <span class="hljs-string">&quot;mybatis&quot;</span>,<br>	<span class="hljs-string">&quot;springframework&quot;</span>, <span class="hljs-string">&quot;slf4j&quot;</span>,<br>&#125;<br></code></pre></td></tr></table></figure>
402
403<p>所以这也导致了一个问题,不能从顶层上直接扫描</p>
404<p><img src="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240929124102-qjfancc.png" srcset="/img/loading.gif" lazyload alt="image"></p>
405<p><code>请把CodeScan放在Net同级目录下扫描(否则会忽略掉直接一个Java目录)</code>​</p>
406<p>请<code>-d</code>​后面的参数尽量在<code>/src/main/java</code>​之后,比如这里就需要把CodeScan放到<code>net</code>​目录下开始扫描</p>
407<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">CodeScan_windows_amd64.exe -L java -d ./net<br></code></pre></td></tr></table></figure>
408
409<h3 id="过滤字符串-只写了JSP-PHP"><a href="#过滤字符串-只写了JSP-PHP" class="headerlink" title="过滤字符串(只写了JSP + PHP)"></a>过滤字符串(只写了JSP + PHP)</h3><p>比如现在有一个代码百分百为鉴权代码在JSP中</p>
410<figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs java">&lt;%@ include file=<span class="hljs-string">&quot;../../common/js/CheckSession.jsp&quot;</span>%&gt;<br></code></pre></td></tr></table></figure>
411
412<p>此时可以用一下功能来进行快速获取未鉴权代码</p>
413<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">CodeScan_windows_amd64.exe -d ./yuan -m <span class="hljs-string">&quot;CheckSession.jsp&quot;</span><br></code></pre></td></tr></table></figure>
414
415<p>此时会将不存在这个代码的文件都放到<code>NoAuthDir</code>​目录中,然后可以再扫一遍就可以立刻定位到存在未鉴权并且存在Sink点的函数文件了</p>
416<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">CodeScan_windows_amd64.exe -L java -d ./NoAuthDir<br></code></pre></td></tr></table></figure>
417
418<p>‍</p>
419<h3 id="静态分析依赖情况"><a href="#静态分析依赖情况" class="headerlink" title="静态分析依赖情况"></a>静态分析依赖情况</h3><p>只需要在CodeScan的目录下放入EvilJarList.txt即可匹配出来</p>
420<p><code>EvilJarList.txt</code>​ 内容为存在可打漏洞的<code>Jar</code>​,模版如下</p>
421<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><code class="hljs bash">fastjson-1.2.47.jar<br>resin-4.0.63.jar<br>jackson-core-2.13.3.jar<br>c3p0-0.9.5.2.jar<br>commons-beanutils-1.9.4.jar<br>commons-beanutils-1.9.3.jar<br>commons-beanutils-1.9.2.jar<br>commons-collections-3.2.1.jar<br>mysql-connector-java-8.0.17.jar<br>commons-collections4-4.0.jar<br>shiro-core-1.10.1.jar<br>aspectjweaver-1.9.5.jar<br>rome-1.0.jar<br>xstream-1.4.11.1.jar<br>sqlite-jdbc-3.8.9.jar<br>vaadin-server-7.7.14.jar<br>hessian-4.0.63.jar<br></code></pre></td></tr></table></figure>
422
423<p>‍</p>
424<h2 id="TODO"><a href="#TODO" class="headerlink" title="TODO"></a>TODO</h2><ul>
425<li>将结果从TXT转为Excel</li>
426<li>Sink点继续完善</li>
427<li>ASP</li>
428</ul>
429<h2 id="支持项目"><a href="#支持项目" class="headerlink" title="支持项目"></a>支持项目</h2><ul>
430<li>如果有师傅发现Bug或者有更好的建议请提issue感谢</li>
431<li>要是各位师傅通过本人的小工具挖到一些好洞记得回头点点Stars诶</li>
432</ul>
433<p>‍</p>
434<p>‍</p>
435<h2 id="详细使用文章-内附案例"><a href="#详细使用文章-内附案例" class="headerlink" title="详细使用文章(内附案例)"></a>详细使用文章(内附案例)</h2><h3 id="案例"><a href="#案例" class="headerlink" title="案例"></a>案例</h3><p>这里就展示下一些简单的代码,只有自己用了才知道真香</p>
436<h4 id="NginxWebui"><a href="#NginxWebui" class="headerlink" title="NginxWebui"></a>NginxWebui</h4><p>先框架分析为Spring</p>
437<p><img src="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406155237-imb68qu.png" srcset="/img/loading.gif" lazyload alt="image">​</p>
438<p>‍</p>
439<h5 id="任意文件上传"><a href="#任意文件上传" class="headerlink" title="任意文件上传"></a>任意文件上传</h5><p>工具扫描出结果为</p>
440<p><img src="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406155756-ob60ahp.png" srcset="/img/loading.gif" lazyload alt="image">​</p>
441<p>有时候代码就是可以直接秒的,这里发现<code>transferTo</code>​ 这个sink点就在控制层</p>
442<p>‍</p>
443<p>找到<code>src/main/java/com/cym/controller/adminPage/MainController.java</code>​</p>
444<p><img src="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406155950-rnf1w3w.png" srcset="/img/loading.gif" lazyload alt="image">​</p>
445<p><img src="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406160610-h206usc.png" srcset="/img/loading.gif" lazyload alt="image">​</p>
446<p>这种名字可以进行跨目录上传</p>
447<p>直接传即可上传成功</p>
448<p><img src="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406160326-n6xok99.png" srcset="/img/loading.gif" lazyload alt="image">​</p>
449<p>报文</p>
450<figure class="highlight yaml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br></pre></td><td class="code"><pre><code class="hljs yaml"><span class="hljs-string">POST</span> <span class="hljs-string">/admiNPage/main/upload</span> <span class="hljs-string">HTTP/1.1</span><br><span class="hljs-attr">Host:</span> <span class="hljs-string">localhost:8080</span><br><span class="hljs-attr">Accept:</span> <span class="hljs-string">application/json,</span> <span class="hljs-string">text/javascript,</span> <span class="hljs-string">*/*;</span> <span class="hljs-string">
450q=0.01</span><br><span class="hljs-attr">Accept-Encoding:</span> <span class="hljs-string">gzip,</span> <span class="hljs-string">deflate,</span> <span class="hljs-string">br,</span> <span class="hljs-string">zstd</span><br><span class="hljs-attr">Accept-Language:</span> <span class="hljs-string">zh-CN,zh;q=0.9</span><br><span class="hljs-attr">Content-Length:</span> <span class="hljs-number">0</span><br><span class="hljs-attr">Origin:</span> <span class="hljs-string">http://localhost:8080</span><br><span class="hljs-attr">Referer:</span> <span class="hljs-string">http://localhost:8080/adminPage/monitor</span><br><span class="hljs-attr">Sec-Fetch-Dest:</span> <span class="hljs-string">empty</span><br><span class="hljs-attr">Sec-Fetch-Mode:</span> <span class="hljs-string">cors</span><br><span class="hljs-attr">Sec-Fetch-Site:</span> <span class="hljs-string">same-origin</span><br><span class="hljs-attr">User-Agent:</span> <span class="hljs-string">Mozilla/5.0</span> <span class="hljs-string">(Windows</span> <span class="hljs-string">NT</span> <span class="hljs-number">10.0</span><span class="hljs-string">;</span> <span class="hljs-string">Win64;</span> <span class="hljs-string">x64)</span> <span class="hljs-string">AppleWebKit/537.36</span> <span class="hljs-string">(KHTML,</span> <span class="hljs-string">like</span> <span class="hljs-string">Gecko)</span> <span class="hljs-string">Chrome/123.0.0.0</span> <span class="hljs-string">Safari/537.36</span><br><span class="hljs-attr">X-Requested-With:</span> <span class="hljs-string">XMLHttpRequest</span><br><span class="hljs-attr">sec-ch-ua:</span> <span class="hljs-string">&quot;Google Chrome&quot;</span><span class="hljs-string">;v=&quot;123&quot;,</span> <span class="hljs-string">&quot;Not:A-Brand&quot;</span><span class="hljs-string">;v=&quot;8&quot;,</span> <span class="hljs-string">&quot;Chromium&quot;</span><span class="hljs-string">;v=&quot;123&quot;</span><br><span class="hljs-attr">sec-ch-ua-mobile:</span> <span class="hljs-string">?0</span><br><span class="hljs-attr">sec-ch-ua-platform:</span> <span class="hljs-string">&quot;Windows&quot;</span><br><span class="hljs-attr">Content-Type:</span> <span class="hljs-string">multipart/form-data;</span> <span class="hljs-string">boundary=----WebKitFormBoundarye8FPHsIAq9JN8j2A</span><br> <br><span class="hljs-string">------WebKitFormBoundarye8FPHsIAq9JN8j2A</span><br><span class="hljs-attr">Content-Disposition:</span> <span class="hljs-string">form-data;</span> <span class="hljs-string">name=&quot;file&quot;;filename=&quot;../3.jsp&quot;</span><br><span class="hljs-attr">Content-Type:</span> <span class="hljs-string">image/jpeg</span><br> <br>&lt;%<span class="language-ruby">out.print(<span class="hljs-string">&quot;test&quot;</span>);</span>%&gt;<br><span class="hljs-string">------WebKitFormBoundarye8FPHsIAq9JN8j2A--</span><br><br></code></pre></td></tr></table></figure>
451
452<p><img src="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406160725-a19hq1m.png" srcset="/img/loading.gif" lazyload alt="image">​</p>
453<p>‍</p>
454<h5 id="RCE"><a href="#RCE" class="headerlink" title="RCE"></a>RCE</h5><p><img src="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406161504-eys6pkt.png" srcset="/img/loading.gif" lazyload alt="image">​</p>
455<p>直接去找了下控制层的代码</p>
456<p><img src="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406161613-ujiovc5.png" srcset="/img/loading.gif" lazyload alt="image">​</p>
457<p><img src="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406161722-27awoxu.png" srcset="/img/loading.gif" lazyload alt="image">​</p>
458<p>emmm这代码可真弱智,再去调用控制层的代码。。。</p>
459<p><img src="https://zjacky-blog.oss-cn-beijing.aliyuncs.com/image-20240406161933-tsbc5fw.png" srcset="/img/loading.gif" lazyload alt="image">​</p>
460<p>‍</p>
461<p>由于一些闭源代码不适合放,因此就拿个开源的nday来进行分析吧,其实原理懂了之后只是合适辅助罢了,但我看开源上都没有人写过,也是就造下轮子开源出来了</p>
462<p>‍</p>
463
464                
465              </div>
466            
467            <hr/>
468            <div>
469              <div class="post-metas my-3">
470  
471  
472</div>
473
474
475              
476  
477
478  <div class="license-box my-3">
479    <div class="license-title">
480      <div>开发 - CodeScan</div>
481      <div>https://zjackky.github.io/post/develop-codescan-zwcz53.html</div>
482    </div>
483    <div class="license-meta">
484      
485        <div class="license-meta-item">
486          <div>作者</div>
487          <div>Zjacky</div>
488        </div>
489      
490      
491        <div class="license-meta-item license-meta-date">
492          <div>发布于</div>
493          <div>2024年9月28日</div>
494        </div>
495      
496      
497      
498        <div class="license-meta-item">
499          <div>许可协议</div>
500          <div>
501            
502              
503              
504                <a class="print-no-link" target="_blank" href="https://creativecommons.org/licenses/by/4.0/">
505                  <span class="hint--top hint--rounded" aria-label="BY - 署名">
506                    <i class="iconfont icon-by"></i>
507                  </span>
508                </a>
509              
510            
511          </div>
512        </div>
513      
514    </div>
515    <div class="license-icon iconfont"></div>
516  </div>
517
518
519
520              
521                <div class="post-prevnext my-3">
522                  <article class="post-prev col-6">
523                    
524                    
525                  </article>
526                  <article class="post-next col-6">
527                    
528                    
529                      <a href="/post/java-security-yangcheng-web-title-readns-1mzaln.html" title="CTF - 羊城Web题解(近况)">
530                        <span class="hidden-mobile">CTF - 羊城Web题解(近况)</span>
531                        <span class="visible-mobile">下一篇</span>
532                        <i class="iconfont icon-arrowright"></i>
533                      </a>
534                    
535                  </article>
536                </div>
537              
538            </div>
539
540            
541  
542  
543    <article id="comments" lazyload>
544      
545  
545<script type="text/javascript">
546    Fluid.utils.loadComments('#comments', function() {
547      var light = 'github-light';
548      var dark = 'github-dark';
549      var schema = document.documentElement.getAttribute('data-user-color-scheme');
550      if (schema === 'dark') {
551        schema = dark;
552      } else {
553        schema = light;
554      }
555      window.UtterancesThemeLight = light;
556      window.UtterancesThemeDark = dark;
557      var s = document.createElement('script');
558      s.setAttribute('src', 'https://utteranc.es/client.js');
559      s.setAttribute('repo', 'Zjackky/Zjackky.github.io');
560      s.setAttribute('issue-term', 'pathname');
561      
562      s.setAttribute('label', 'utterances');
563      
564      s.setAttribute('theme', schema);
565      s.setAttribute('crossorigin', 'anonymous');
566      document.getElementById('comments').appendChild(s);
567    })
568  </script>
568
569  <noscript>Please enable JavaScript to view the comments</noscript>
570
571
572    </article>
573  
574
575
576          </article>
577        </div>
578      </div>
579    </div>
580
581    <div class="side-col d-none d-lg-block col-lg-2">
582      
583
584    </div>
585  </div>
586</div>
587
588
589
590
591
592  
593
594
595
596  
597
598
599
600  
601
602
603
604  
605
606
607
608  
609
610
611
612
613
614
615
616    
617
618    
619      <a id="scroll-top-button" aria-label="TOP" href="#" role="button">
620        <i class="iconfont icon-arrowup" aria-hidden="true"></i>
621      </a>
622    
623
624    
625      <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
626     aria-hidden="true">
627  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
628    <div class="modal-content">
629      <div class="modal-header text-center">
630        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
631        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
632          <span aria-hidden="true">&times;</span>
633        </button>
634      </div>
635      <div class="modal-body mx-3">
636        <div class="md-form mb-5">
637          <input type="text" id="local-search-input" class="form-control validate">
638          <label data-error="x" data-success="v" for="local-search-input">关键词</label>
639        </div>
640        <div class="list-group" id="local-search-result"></div>
641      </div>
642    </div>
643  </div>
644</div>
645
646    
647
648    
649  </main>
650
651  <footer>
652    <div class="footer-inner">
653  
654    <div class="footer-content">
655       <a href="https://github.com/Zjackky/Zjackky.github.io" target="_blank" rel="nofollow noopener"><span>My Github</span></a> <i class="iconfont icon-love"></i> <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>Fluid</span></a> <div style="font-size: 0.85rem"> <span id="timeDate">载入天数...</span> <span id="times">载入时分秒...</span> 
655<script src="/js/duration.js"></script>
655 </div> 
656    </div>
657  
658  
659    <div class="statistics">
660  
661  
662
663  
664    
665      <span id="busuanzi_container_site_pv" style="display: none">
666        总访问量 
667        <span id="busuanzi_value_site_pv"></span>
668         次
669      </span>
670    
671    
672      <span id="busuanzi_container_site_uv" style="display: none">
673        总访客数 
674        <span id="busuanzi_value_site_uv"></span>
675         人
676      </span>
677    
678    
679  
680</div>
681
682  
683  
684  
685</div>
686
687  </footer>
688
689  <!-- Scripts -->
690  
691  
691<script  src="https://lib.baomitu.com/nprogress/0.2.0/nprogress.min.js" ></script>
691
692  <link  rel="stylesheet" href="https://lib.baomitu.com/nprogress/0.2.0/nprogress.min.css" />
693
694  
694<script>
695    NProgress.configure({"showSpinner":false,"trickleSpeed":100})
696    NProgress.start()
697    window.addEventListener('load', function() {
698      NProgress.done();
699    })
700  </script>
700
701
702
703<script  src="https://lib.baomitu.com/jquery/3.6.4/jquery.min.js" ></script>
vendor: 1 bytes, line 703
703
704<script  src="https://lib.baomitu.com/twitter-bootstrap/4.6.1/js/bootstrap.min.js" ></script>
vendor: 1 bytes, line 704
704
705<script  src="/js/events.js" ></script>
vendor: 1 bytes, line 705
705
706<script  src="/js/plugins.js" ></script>
706
707
708
709  
709<script  src="https://lib.baomitu.com/typed.js/2.0.12/typed.min.js" ></script>
709
710  
710<script>
711    (function (window, document) {
712      var typing = Fluid.plugins.typing;
713      var subtitle = document.getElementById('subtitle');
714      if (!subtitle || !typing) {
715        return;
716      }
717      var text = subtitle.getAttribute('data-typed-text');
718      
719        typing(text);
720      
721    })(window, document);
722  </script>
722
723
724
725
726
727  
728    
728<script  src="/js/img-lazyload.js" ></script>
728
729  
730
731
732
733
734  
735<script>
736  Fluid.utils.createScript('https://lib.baomitu.com/tocbot/4.20.1/tocbot.min.js', function() {
737    var toc = jQuery('#toc');
738    if (toc.length === 0 || !window.tocbot) { return; }
739    var boardCtn = jQuery('#board-ctn');
740    var boardTop = boardCtn.offset().top;
741
742    window.tocbot.init(Object.assign({
743      tocSelector     : '#toc-body',
744      contentSelector : '.markdown-body',
745      linkClass       : 'tocbot-link',
746      activeLinkClass : 'tocbot-active-link',
747      listClass       : 'tocbot-list',
748      isCollapsedClass: 'tocbot-is-collapsed',
749      collapsibleClass: 'tocbot-is-collapsible',
750      scrollSmooth    : true,
751      includeTitleTags: true,
752      headingsOffset  : -boardTop,
753    }, CONFIG.toc));
754    if (toc.find('.toc-list-item').length > 0) {
755      toc.css('visibility', 'visible');
756    }
757
758    Fluid.events.registerRefreshCallback(function() {
759      if ('tocbot' in window) {
760        tocbot.refresh();
761        var toc = jQuery('#toc');
762        if (toc.length === 0 || !tocbot) {
763          return;
764        }
765        if (toc.find('.toc-list-item').length > 0) {
766          toc.css('visibility', 'visible');
767        }
768      }
769    });
770  });
771</script>
771
772
773
774  
774<script src=https://lib.baomitu.com/clipboard.js/2.0.11/clipboard.min.js></script>
774
775
776  
776<script>Fluid.plugins.codeWidget();</script>
776
777
778
779  
780<script>
781  Fluid.utils.createScript('https://lib.baomitu.com/anchor-js/4.3.1/anchor.min.js', function() {
782    window.anchors.options = {
783      placement: CONFIG.anchorjs.placement,
784      visible  : CONFIG.anchorjs.visible
785    };
786    if (CONFIG.anchorjs.icon) {
787      window.anchors.options.icon = CONFIG.anchorjs.icon;
788    }
789    var el = (CONFIG.anchorjs.element || 'h1,h2,h3,h4,h5,h6').split(',');
790    var res = [];
791    for (var item of el) {
792      res.push('.markdown-body > ' + item.trim());
793    }
794    if (CONFIG.anchorjs.placement === 'left') {
795      window.anchors.options.class = 'anchorjs-link-left';
796    }
797    window.anchors.add(res.join(', '));
798
799    Fluid.events.registerRefreshCallback(function() {
800      if ('anchors' in window) {
801        anchors.removeAll();
802        var el = (CONFIG.anchorjs.element || 'h1,h2,h3,h4,h5,h6').split(',');
803        var res = [];
804        for (var item of el) {
805          res.push('.markdown-body > ' + item.trim());
806        }
807        if (CONFIG.anchorjs.placement === 'left') {
808          anchors.options.class = 'anchorjs-link-left';
809        }
810        anchors.add(res.join(', '));
811      }
812    });
813  });
814</script>
814
815
816
817  
818<script>
819  Fluid.utils.createScript('https://lib.baomitu.com/fancybox/3.5.7/jquery.fancybox.min.js', function() {
820    Fluid.plugins.fancyBox();
821  });
822</script>
822
823
824
825  
825<script>Fluid.plugins.imageCaption();</script>
825
826
827  
827<script  src="/js/local-search.js" ></script>
827
828
829  
829<script defer src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js" ></script>
829
830
831
832
833
834
835<!-- 主题的启动项,将它保持在最底部 -->
836<!-- the boot of the theme, keep it at the bottom -->
837<script  src="/js/boot.js" ></script>
837
838
839
840  
841
842  <noscript>
843    <div class="noscript-warning">博客在允许 JavaScript 运行的环境下浏览效果更佳</div>
844  </noscript>
845</body>
846</html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.