Repository navigation
Expand file tree
/
Copy pathindex.html
More file actions
303 lines (276 loc) · 39.5 KB
/
Copy pathindex.html
File metadata and controls
303 lines (276 loc) · 39.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
<!DOCTYPE html><html lang="zh-CN" data-theme="light"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0,viewport-fit=cover"><title>红烧花园宝宝</title><meta name="author" content="红烧花园宝宝"><meta name="copyright" content="红烧花园宝宝"><meta name="format-detection" content="telephone=no"><meta name="theme-color" content="#ffffff"><meta name="description" content="生命只有一次,只能爱你一世">
<meta property="og:type" content="website">
<meta property="og:title" content="红烧花园宝宝">
<meta property="og:url" content="https://lxu2n.github.io/index.html">
<meta property="og:site_name" content="红烧花园宝宝">
<meta property="og:description" content="生命只有一次,只能爱你一世">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://lxu2n.github.io/image/1.png">
<meta property="article:author" content="红烧花园宝宝">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://lxu2n.github.io/image/1.png"><link rel="shortcut icon" href="/image/6.png"><link rel="canonical" href="https://lxu2n.github.io/index.html"><link rel="preconnect" href="//cdn.jsdelivr.net"><link rel="preconnect" href="//busuanzi.ibruce.info"><link rel="stylesheet" href="/css/index.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free/css/all.min.css"><script>
(() => {
const saveToLocal = {
set: (key, value, ttl) => {
if (!ttl) return
const expiry = Date.now() + ttl * 86400000
localStorage.setItem(key, JSON.stringify({ value, expiry }))
},
get: key => {
const itemStr = localStorage.getItem(key)
if (!itemStr) return undefined
const { value, expiry } = JSON.parse(itemStr)
if (Date.now() > expiry) {
localStorage.removeItem(key)
return undefined
}
return value
}
}
window.btf = {
saveToLocal,
getScript: (url, attr = {}) => new Promise((resolve, reject) => {
const script = document.createElement('script')
script.src = url
script.async = true
Object.entries(attr).forEach(([key, val]) => script.setAttribute(key, val))
script.onload = script.onreadystatechange = () => {
if (!script.readyState || /loaded|complete/.test(script.readyState)) resolve()
}
script.onerror = reject
document.head.appendChild(script)
}),
getCSS: (url, id) => new Promise((resolve, reject) => {
const link = document.createElement('link')
link.rel = 'stylesheet'
link.href = url
if (id) link.id = id
link.onload = link.onreadystatechange = () => {
if (!link.readyState || /loaded|complete/.test(link.readyState)) resolve()
}
link.onerror = reject
document.head.appendChild(link)
}),
addGlobalFn: (key, fn, name = false, parent = window) => {
if (!false && key.startsWith('pjax')) return
const globalFn = parent.globalFn || {}
globalFn[key] = globalFn[key] || {}
globalFn[key][name || Object.keys(globalFn[key]).length] = fn
parent.globalFn = globalFn
}
}
const activateDarkMode = () => {
document.documentElement.setAttribute('data-theme', 'dark')
if (document.querySelector('meta[name="theme-color"]') !== null) {
document.querySelector('meta[name="theme-color"]').setAttribute('content', '#0d0d0d')
}
}
const activateLightMode = () => {
document.documentElement.setAttribute('data-theme', 'light')
if (document.querySelector('meta[name="theme-color"]') !== null) {
document.querySelector('meta[name="theme-color"]').setAttribute('content', '#ffffff')
}
}
btf.activateDarkMode = activateDarkMode
btf.activateLightMode = activateLightMode
const theme = saveToLocal.get('theme')
theme === 'dark' ? activateDarkMode() : theme === 'light' ? activateLightMode() : null
const asideStatus = saveToLocal.get('aside-status')
if (asideStatus !== undefined) {
document.documentElement.classList.toggle('hide-aside', asideStatus === 'hide')
}
const detectApple = () => {
if (/iPad|iPhone|iPod|Macintosh/.test(navigator.userAgent)) {
document.documentElement.classList.add('apple')
}
}
detectApple()
})()
</script><script>const GLOBAL_CONFIG = {
root: '/',
algolia: undefined,
localSearch: {"path":"/search.xml","preload":false,"top_n_per_article":1,"unescape":false,"languages":{"hits_empty":"未找到符合您查询的内容:${query}","hits_stats":"共找到 ${hits} 篇文章"}},
translate: undefined,
highlight: {"plugin":"highlight.js","highlightCopy":true,"highlightLang":true,"highlightHeightLimit":false,"highlightFullpage":false,"highlightMacStyle":false},
copy: {
success: '复制成功',
error: '复制失败',
noSupport: '浏览器不支持'
},
relativeDate: {
homepage: false,
post: false
},
runtime: '天',
dateSuffix: {
just: '刚刚',
min: '分钟前',
hour: '小时前',
day: '天前',
month: '个月前'
},
copyright: undefined,
lightbox: 'medium_zoom',
Snackbar: undefined,
infinitegrid: {
js: 'https://cdn.jsdelivr.net/npm/@egjs/infinitegrid/dist/infinitegrid.min.js',
buttonText: '加载更多'
},
isPhotoFigcaption: false,
islazyloadPlugin: false,
isAnchor: false,
percent: {
toc: true,
rightside: true,
},
autoDarkmode: false
}</script><script id="config-diff">var GLOBAL_CONFIG_SITE = {
title: '红烧花园宝宝',
isHighlightShrink: false,
isToc: false,
pageType: 'home'
}</script></head><body><canvas id="bubble_canvas" style="position:fixed;top:0;left:0;width:100%;height:100%;z-index:999999;pointer-events:none"></canvas><link rel="stylesheet" href="/css/transpancy.css"><link rel="stylesheet" href="/css/modify.css"><link rel="stylesheet" href="/styles/main.css"><link rel="stylesheet" href="/css/beautify.css"><script src="https://cdn.bootcss.com/jquery/3.4.1/jquery.min.js"></script><meta name="generator" content="Hexo 7.3.0"><div id="loading-box"><div class="loading-left-bg"></div><div class="loading-right-bg"></div><div class="spinner-box"><div class="configure-border-1"><div class="configure-core"></div></div><div class="configure-border-2"><div class="configure-core"></div></div><div class="loading-word">加载中...</div></div></div><script>(()=>{
const $loadingBox = document.getElementById('loading-box')
const $body = document.body
const preloader = {
endLoading: () => {
$body.style.overflow = ''
$loadingBox.classList.add('loaded')
},
initLoading: () => {
$body.style.overflow = 'hidden'
$loadingBox.classList.remove('loaded')
}
}
preloader.initLoading()
window.addEventListener('load', preloader.endLoading)
if (false) {
btf.addGlobalFn('pjaxSend', preloader.initLoading, 'preloader_init')
btf.addGlobalFn('pjaxComplete', preloader.endLoading, 'preloader_end')
}
})()</script><div id="web_bg" style="background-image: url(/image/2.png);"></div><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="avatar-img text-center"><img src="/image/1.png" onerror="this.onerror=null;this.src='/img/friend_404.gif'" alt="avatar"></div><div class="site-data text-center"><a href="/archives/"><div class="headline">文章</div><div class="length-num">64</div></a><a href="/tags/"><div class="headline">标签</div><div class="length-num">0</div></a><a href="/categories/"><div class="headline">分类</div><div class="length-num">16</div></a></div><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page" href="/archives"><i class="fa-fw fas fa-archive"></i><span> 归档</span></a></div><div class="menus_item"><a class="site-page" href="/categories"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></div><div class="menus_item"><a class="site-page" href="/daily/"><i class="fa-fw fas fa-mug-hot"></i><span> 日常</span></a></div></div></div></div><div class="page" id="body-wrap"><header class="full_page" id="page-header" style="background: transparent;"><nav id="nav"><!-- 左侧博客信息区域--><span id="blog-info"><a class="nav-site-title" href="/"><img class="site-icon" src="/image/6.png" alt="Logo"><span class="site-name">红烧花园宝宝</span></a></span><!-- 新增的导航菜单容器(居中布局关键)--><div id="nav-menus-container"><!-- 菜单主体部分--><div id="menus"><!-- 菜单项--><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page" href="/archives"><i class="fa-fw fas fa-archive"></i><span> 归档</span></a></div><div class="menus_item"><a class="site-page" href="/categories"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></div><div class="menus_item"><a class="site-page" href="/daily/"><i class="fa-fw fas fa-mug-hot"></i><span> 日常</span></a></div></div></div></div><!-- 右侧功能区域(新增容器)--><div id="nav-right-container"><!-- 搜索按钮(移动到右侧)--><div id="search-button"><span class="site-page social-icon search"><i class="fas fa-search fa-fw"></i><span> 搜索</span></span></div><!-- 移动端汉堡菜单按钮--><div id="toggle-menu"><span class="site-page"><i class="fas fa-bars fa-fw"></i></span></div></div></nav><div id="site-info"><h1 id="site-title">红烧花园宝宝</h1><div id="site-subtitle"><span id="subtitle"></span></div></div><div id="scroll-down"><i class="fas fa-angle-down scroll-down-effects"></i></div></header><main class="layout" id="content-inner"><div class="recent-posts nc" id="recent-posts"><div class="recent-post-items"><div class="recent-post-item"><div class="recent-post-info no-cover"><a class="article-title" href="/posts/4ac0d1b6/" title="fastjson1.2.83(半成品)">fastjson1.2.83(半成品)</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2026-09-13T12:37:48.000Z" title="发表于 2026-09-13 20:37:48">2026-09-13</time></span></div><div class="content">前言这个漏洞也是爆出来过了好长时间了,一直没有复现,所以这两天打算复现一下 什么是AutoType简单理解一下,AutoType的提出是为了处理java多态场景:当把一个对象序列化生成一个字符串时,这个字符串就会丢失对象的具体信息,导致反序列化时是无法恢复成原本的子类或实现类的(简单举个例子,如果是一个Animal接口,它的实现类是dog和cat,那么序列化后,在反序列化后,fastjson就不清楚实例化成什么),所以AutoType是为了记录序列化对象的真正的类名。那么,因为@type指定的值会被当做一个java类,创建它的实例,所以就会导致很多的漏洞。最后到1.2.83的整体AutoType的机制是: 先判断是否开启了safeMode模式,如果开启了这个模式checkAutoType会直接抛出异常,这也就意味着AutoType被禁用了 如果safeMode,被关闭,这就会进入checkAutoType去进行判断,首先匹配白名单,如果该类是在白名单中,直接就实例化,如果不在就进行下一步,也就是进行黑名单匹配,如果在黑名单,就直接抛出异常,如果不在,就进行一下步的判断 是关于a...</div></div></div><div class="recent-post-item"><div class="recent-post-info no-cover"><a class="article-title" href="/posts/f6e14a77/" title="红日靶场2">红日靶场2</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2026-06-29T06:59:47.000Z" title="发表于 2026-06-29 14:59:47">2026-06-29</time></span><span class="article-meta"><span class="article-meta-separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/%E6%89%93%E9%9D%B6/">打靶</a></span></div><div class="content">外网信息收集端口扫描接着进行了漏洞扫描发现是weblogic,尝试getshell注入冰蝎内存马然后连接 内网信息收集先上线cs然后进行信息收集shell ipconfig /all发现域(一般发现的这个也就是域控(DC)) 123456789101112net view # 查看局域网内其他主机名net config Workstation # 查看计算机名、全名、用户名、系统版本、工作站、域、登录域net user # 查看本机用户列表net user /domain # 查看域用户net localgroup administrators # 查看本地管理员组(通常会有域用户)net view /domain # 查看有几个域net user 用户名 /domain # 获取指定域用户的信息net group /domain # 查看域里面的工作组,查看把用户分了多少组(只能在域控上操作)net group 组名 /domain # 查看域中...</div></div></div><div class="recent-post-item"><div class="recent-post-info no-cover"><a class="article-title" href="/posts/1f484d15/" title="Tsclient">Tsclient</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2026-06-16T09:06:47.000Z" title="发表于 2026-06-16 17:06:47">2026-06-16</time></span><span class="article-meta"><span class="article-meta-separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/%E6%89%93%E9%9D%B6/">打靶</a></span></div><div class="content">flag1 fscan扫描出可利用的信息 使用MDUT进行连接 这里SeImpersonatePrivilege 身份验证后模拟客户端 已启用可以使用sweetpotato进行提权 尝试上线cs 上线成功,接着进行提权 然后我们看看flag 在哪里,这里找就有点麻烦了,我们可以将system上线 在MDUT执行命令 1shell C:\Users\Public\SweetPotato.exe -a C:\Users\Public\artifact_x64.exe 上线成功 得到flag 1flag{4f89fd8a-ce68-4d65-821a-778b52fe742c} flag2让我们注重用户会话 查看在线用户 1shell quser || qwinst 可以使用cs注入进程上线 点击注入,上线成功 查看共享资源 1shell net use 查看目录 给出账号密码,并且提示是映像劫持 1xiaorang.lab\Aldrich:Ald@rLMWuy7Z!# 使用fscan扫描,因为有乱码,然后输出到文...</div></div></div><div class="recent-post-item"><div class="recent-post-info no-cover"><a class="article-title" href="/posts/6fe81bcd/" title="红日靶场1">红日靶场1</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2026-06-16T08:52:44.000Z" title="发表于 2026-06-16 16:52:44">2026-06-16</time></span><span class="article-meta"><span class="article-meta-separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/%E6%89%93%E9%9D%B6/">打靶</a></span></div><div class="content">前言靶场来自无境,尽量写的详细一点 过程web渗透-sql日志首页使用tscan进行目录扫描访问phpMyAdmin后台,root/rootshow variables like '%general%'这里显示的日志的开关以及日志存放的位置我们要做的事将一句话代码写进shell.php中,将日志开关打开,然后改变日志存储的文件位置set global general_log = "on"set global general_log_file = "C:\\phpStudy\\WWW\\shell.php"然后使用蚁剑连接; web渗透-YXcms这个是在目录是在御剑里扫描出来的http://192.168.111.20/yxcms/index.php/尝试登录这里的模板文件是可以编辑的,我们写入一句话木马。继续扫描发现目标文件http://192.168.111.20/yxcms/protected/apps/default/view/default/info.php 后渗透前期准备接着我们上线msf生成木马ms...</div></div></div><div class="recent-post-item"><div class="recent-post-info no-cover"><a class="article-title" href="/posts/7ca98e62/" title="java代码审计之sql注入">java代码审计之sql注入</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2026-05-15T04:14:00.000Z" title="发表于 2026-05-15 12:14:00">2026-05-15</time></span><span class="article-meta"><span class="article-meta-separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/Java%E5%AE%89%E5%85%A8/">Java安全</a><i class="fas fa-angle-right article-meta-link"></i><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/Java%E5%AE%89%E5%85%A8/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/">代码审计</a></span></div><div class="content">前言最近在疯狂打游戏哈,有点懈怠了,所以赶紧去来补一下java的代码审计,上一篇的xss是找了个视频,随便写了点,这个就认真一点,依旧找个博客跟着大佬学习。项目地址:JoyChou93/java-sec-code: Java web common vulnerabilities and security code which is base on springboot and spring security jdbc的拼接不当导致的sql注入在jdbc中存在两个sql语句来执行sql,一个是Statement,另一个是PreparedStatement。那么他们的写法分别是 Statement1234Connection con = DriverManager.getConnection(url, user, password);Statement statement = con.createStatement();String sql = "select * from users where username = '" + usernam...</div></div></div><div class="recent-post-item"><div class="recent-post-info no-cover"><a class="article-title" href="/posts/13c61d37/" title="java代码审计之xss">java代码审计之xss</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2026-05-02T05:15:15.000Z" title="发表于 2026-05-02 13:15:15">2026-05-02</time></span><span class="article-meta"><span class="article-meta-separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/Java%E5%AE%89%E5%85%A8/">Java安全</a><i class="fas fa-angle-right article-meta-link"></i><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/Java%E5%AE%89%E5%85%A8/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/">代码审计</a></span></div><div class="content">前言虽然不是很多但是也要记录一下,好久没发过博客了,简单水一下 XSS漏洞原理三个关键:参数必须传递到后端、参数必须不可控、参数必须被浏览器解析。恶意攻击者往web页面插入恶意Script代码,当用户浏览该页之时,嵌入web页面中的script代码会被执行,从而达到攻击的效果。 XSS漏洞的审计方法关注用户可控终端(用户的输入),传入后端的参数且返回给浏览器被解析。 使用Servlet技术:request.getParameter("name") 使用Struts2框架:(1)通过Action类绑定参数或model获取前端的参数123456789<form action="login.action" method="post"> 账号:<input type="text" name="name"> 密码:<input type="password" name="password">...</div></div></div><div class="recent-post-item"><div class="recent-post-info no-cover"><a class="article-title" href="/posts/17f04675/" title="java内存马_8">java内存马_8</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2026-03-31T12:47:42.000Z" title="发表于 2026-03-31 20:47:42">2026-03-31</time></span><span class="article-meta"><span class="article-meta-separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/Java%E5%AE%89%E5%85%A8/">Java安全</a><i class="fas fa-angle-right article-meta-link"></i><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/Java%E5%AE%89%E5%85%A8/java%E5%86%85%E5%AD%98%E9%A9%AC/">java内存马</a></span></div><div class="content">前言上次讲到了使用反序列化注入的一种回显方法-ThreadLocal回显,这次我们来学习一下另一种-全局Response回显。 全局Response分析之前在学习servlet内存马的时候,我们对请求的获取分析是从Http11Processor开始的,这次我们起一个简单的服务回看整个调用栈,找到Http11Processor这个类,我们会看到出现了request和response,我们可以看到这两个属性是来自它的父类AbstractProcessor那我们要想怎么获取到AbstractProcessor这个类,回看调用栈可以看到AbstractProcessor这个类是继承于AbstractProcessorLight,而AbstractProcessorLight又出在了调用栈中,但是调用栈是没有AbstractProcessor这个类的引用的,我们只能使用Http11Processor来获取request和response。所以问题还是抛给到了对Http11Processor的获取。这就来到了ConnectionHandler这里就注册了Http11Processor这个类,...</div></div></div><div class="recent-post-item"><div class="recent-post-info no-cover"><a class="article-title" href="/posts/874f5be4/" title="java内存马_7">java内存马_7</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2026-03-07T12:23:25.000Z" title="发表于 2026-03-07 20:23:25">2026-03-07</time></span><span class="article-meta"><span class="article-meta-separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/Java%E5%AE%89%E5%85%A8/">Java安全</a><i class="fas fa-angle-right article-meta-link"></i><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/Java%E5%AE%89%E5%85%A8/java%E5%86%85%E5%AD%98%E9%A9%AC/">java内存马</a></span></div><div class="content">前言也算是和利用有关 之前分析的几个内存马,jsp类型的是可以通过文件上传来注入利用的,但是如果直接注入,那么就得用到反序列化,那么我们就要考虑回显问题了(jsp是内置了request和response的),今天要学习两个方法来解决这个问题 使用ThreadLocal Response 回显,原理是从ApplicationFilterChain类中获取到response对象。当然如果漏洞是在ApplicationFilterChain之前的话,这个方法就不能使用了。 通过全局Response回显,寻找tomcat在处理servlet、filter之前有没有存储Response变量。 TreadLocal Response回显什么是TreadLocalTreadLocal就是线程安全,它是怎么做到安全的呢?举个例子:如果现在不安全的情况下,比如有很多人同时向服务器去请求不同数量的同一个东西,那么第一个人如果要10个,其他人也都会得到10个(因为是并发),拿不到预期想要的东西。如果要解决这种问题就可以使用TreadLocal,创建一个独立的变量域,这样就不会出现线程间的变量覆盖这...</div></div></div><div class="recent-post-item"><div class="recent-post-info no-cover"><a class="article-title" href="/posts/873dd98/" title="CORS漏洞">CORS漏洞</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2026-02-24T05:55:04.000Z" title="发表于 2026-02-24 13:55:04">2026-02-24</time></span><span class="article-meta"><span class="article-meta-separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/%E7%9F%A5%E8%AF%86%E7%82%B9/">知识点</a></span></div><div class="content">前言最近了解到了CORS漏洞,赶紧来学一下。 CORS概念同源策略在讲CORS之前,要先知道同源策略这个机制,这个机制是浏览器的安全核心,它规定,如果两个页面的协议、端口和域名不完全相同,那么它们就是不同源的。浏览器会限制不同源的文档或脚本相互读取数据(例如,防止站点 A 的脚本读取站点 B 的 Cookie 或页面内容)。 CORS而在实际的web开发中,经常需要跨域请求数据,例如:前端在www.a.com,api接口在api.b.com这样前端去向api进行一个请求,就是跨域的请求。CORS就是用来打破同源策略的,它通过在服务端的 HTTP 响应头中添加特定的字段,告诉浏览器:“我允许这个外域的页面来读取我的数据”。 CORS漏洞CORS 漏洞并不是 CORS 机制本身的设计缺陷,而是服务端开发人员在配置 CORS 策略时出现了错误,导致权限放得过宽。当服务端没有严格校验请求的来源(Origin),并且允许跨域携带凭证(如 Cookie)时,攻击者就可以通过构造恶意网页,欺骗受害者访问,从而在受害者不知情的情况下,以受害者的身份向存在漏洞的网站发起请求并窃取敏感数据。 漏洞的...</div></div></div><div class="recent-post-item"><div class="recent-post-info no-cover"><a class="article-title" href="/posts/f0486b72/" title="java内存马_6">java内存马_6</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2026-02-23T06:31:15.000Z" title="发表于 2026-02-23 14:31:15">2026-02-23</time></span><span class="article-meta"><span class="article-meta-separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/Java%E5%AE%89%E5%85%A8/">Java安全</a><i class="fas fa-angle-right article-meta-link"></i><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/Java%E5%AE%89%E5%85%A8/java%E5%86%85%E5%AD%98%E9%A9%AC/">java内存马</a></span></div><div class="content">前言Valve内存马是和filter,listener,sevlet内存马是不同的,后三者的内存马是放在web的请求中的,而Valve的内存马是放在Pipeline的流程中的。 什么是Valve因为前面可能只是提了一下valve,比如StandardEngineValve,并没有具体的介绍,所以这里具体介绍一下:Tomcat 的容器结构是层级制的(Engine -> Host -> Context -> Wrapper)。每个容器都有一个 Pipeline(管道),而管道中可以挂载多个 Valve(阀门)。例子:当一个请求通过容器时,它会像流水一样流经管道中的每一个阀门。每个阀门负责完成特定的任务,然后将请求传递给下一个阀门,直到最后由 BasicValve(基础阀门)将请求交给子容器或业务逻辑。简单来说,Valve 是 Tomcat 管道(Pipeline) 机制中的一个组件,用于在请求到达最终的 Servlet 之前,对请求进行拦截、处理或过滤。大家可以看这张图辅助理解:其实Valve是和filter很类似的,我们也可以通过特定的方法将我们创造的valve放...</div></div></div></div><nav id="pagination"><div class="pagination"><span class="page-number current">1</span><a class="page-number" href="/page/2/#content-inner">2</a><span class="space">…</span><a class="page-number" href="/page/7/#content-inner">7</a><a class="extend next" rel="next" href="/page/2/#content-inner"><i class="fas fa-chevron-right fa-fw"></i></a></div></nav></div><div class="aside-content" id="aside-content"><div class="card-widget card-info text-center"><div class="avatar-img"><img src="/image/1.png" onerror="this.onerror=null;this.src='/img/friend_404.gif'" alt="avatar"></div><div class="author-info-name">红烧花园宝宝</div><div class="author-info-description">生命只有一次,只能爱你一世</div><div class="site-data"><a href="/archives/"><div class="headline">文章</div><div class="length-num">64</div></a><a href="/tags/"><div class="headline">标签</div><div class="length-num">0</div></a><a href="/categories/"><div class="headline">分类</div><div class="length-num">16</div></a></div><a id="card-info-btn" target="_blank" rel="noopener" href="https://github.com/LXu2n/LXu2n.github.io"><i class="fab fa-github"></i><span>Follow Me</span></a></div><div class="card-widget card-announcement"><div class="item-headline"><i class="fas fa-bullhorn fa-shake"></i><span>公告</span></div><div class="announcement_content">欢迎来到我的博客</div></div><div class="sticky_layout"><div class="card-widget card-recent-post"><div class="item-headline"><i class="fas fa-history"></i><span>最新文章</span></div><div class="aside-list"><div class="aside-list-item no-cover"><div class="content"><a class="title" href="/posts/4ac0d1b6/" title="fastjson1.2.83(半成品)">fastjson1.2.83(半成品)</a><time datetime="2026-09-13T12:37:48.000Z" title="发表于 2026-09-13 20:37:48">2026-09-13</time></div></div><div class="aside-list-item no-cover"><div class="content"><a class="title" href="/posts/f6e14a77/" title="红日靶场2">红日靶场2</a><time datetime="2026-06-29T06:59:47.000Z" title="发表于 2026-06-29 14:59:47">2026-06-29</time></div></div><div class="aside-list-item no-cover"><div class="content"><a class="title" href="/posts/1f484d15/" title="Tsclient">Tsclient</a><time datetime="2026-06-16T09:06:47.000Z" title="发表于 2026-06-16 17:06:47">2026-06-16</time></div></div><div class="aside-list-item no-cover"><div class="content"><a class="title" href="/posts/6fe81bcd/" title="红日靶场1">红日靶场1</a><time datetime="2026-06-16T08:52:44.000Z" title="发表于 2026-06-16 16:52:44">2026-06-16</time></div></div><div class="aside-list-item no-cover"><div class="content"><a class="title" href="/posts/7ca98e62/" title="java代码审计之sql注入">java代码审计之sql注入</a><time datetime="2026-05-15T04:14:00.000Z" title="发表于 2026-05-15 12:14:00">2026-05-15</time></div></div></div></div><div class="card-widget card-categories"><div class="item-headline">
<i class="fas fa-folder-open"></i>
<span>分类</span>
<a class="card-more-btn" href="/categories/" title="查看更多">
<i class="fas fa-angle-right"></i></a>
</div>
<ul class="card-category-list" id="aside-cat-list">
<li class="card-category-list-item "><a class="card-category-list-link" href="/categories/Java%E5%AE%89%E5%85%A8/"><span class="card-category-list-name">Java安全</span><span class="card-category-list-count">35</span></a><ul class="card-category-list child"><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/Java%E5%AE%89%E5%85%A8/Fastjson/"><span class="card-category-list-name">Fastjson</span><span class="card-category-list-count">4</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/Java%E5%AE%89%E5%85%A8/JNDI%E6%B3%A8%E5%85%A5/"><span class="card-category-list-name">JNDI注入</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/Java%E5%AE%89%E5%85%A8/Log4j2/"><span class="card-category-list-name">Log4j2</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/Java%E5%AE%89%E5%85%A8/RMI/"><span class="card-category-list-name">RMI</span><span class="card-category-list-count">2</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/Java%E5%AE%89%E5%85%A8/cc%E9%93%BE/"><span class="card-category-list-name">cc链</span><span class="card-category-list-count">9</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/Java%E5%AE%89%E5%85%A8/java%E5%86%85%E5%AD%98%E9%A9%AC/"><span class="card-category-list-name">java内存马</span><span class="card-category-list-count">8</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/Java%E5%AE%89%E5%85%A8/java%E5%9F%BA%E7%A1%80/"><span class="card-category-list-name">java基础</span><span class="card-category-list-count">3</span></a></li></ul></li>
</ul></div><div class="card-widget card-archives">
<div class="item-headline">
<i class="fas fa-archive"></i>
<span>归档</span>
<a class="card-more-btn" href="/archives/" title="查看更多">
<i class="fas fa-angle-right"></i>
</a>
</div>
<ul class="card-archive-list">
<li class="card-archive-list-item">
<a class="card-archive-list-link" href="/archives/2026/09/">
<span class="card-archive-list-date">
九月 2026
</span>
<span class="card-archive-list-count">1</span>
</a>
</li>
<li class="card-archive-list-item">
<a class="card-archive-list-link" href="/archives/2026/06/">
<span class="card-archive-list-date">
六月 2026
</span>
<span class="card-archive-list-count">3</span>
</a>
</li>
<li class="card-archive-list-item">
<a class="card-archive-list-link" href="/archives/2026/05/">
<span class="card-archive-list-date">
五月 2026
</span>
<span class="card-archive-list-count">2</span>
</a>
</li>
<li class="card-archive-list-item">
<a class="card-archive-list-link" href="/archives/2026/03/">
<span class="card-archive-list-date">
三月 2026
</span>
<span class="card-archive-list-count">2</span>
</a>
</li>
<li class="card-archive-list-item">
<a class="card-archive-list-link" href="/archives/2026/02/">
<span class="card-archive-list-date">
二月 2026
</span>
<span class="card-archive-list-count">9</span>
</a>
</li>
<li class="card-archive-list-item">
<a class="card-archive-list-link" href="/archives/2026/01/">
<span class="card-archive-list-date">
一月 2026
</span>
<span class="card-archive-list-count">7</span>
</a>
</li>
<li class="card-archive-list-item">
<a class="card-archive-list-link" href="/archives/2025/12/">
<span class="card-archive-list-date">
十二月 2025
</span>
<span class="card-archive-list-count">9</span>
</a>
</li>
<li class="card-archive-list-item">
<a class="card-archive-list-link" href="/archives/2025/11/">
<span class="card-archive-list-date">
十一月 2025
</span>
<span class="card-archive-list-count">7</span>
</a>
</li>
</ul>
</div><div class="card-widget card-webinfo"><div class="item-headline"><i class="fas fa-chart-line"></i><span>网站信息</span></div><div class="webinfo"><div class="webinfo-item"><div class="item-name">文章数目 :</div><div class="item-count">64</div></div><div class="webinfo-item"><div class="item-name">运行时间 :</div><div class="item-count" id="runtimeshow" data-publishdate="2025-05-25T00:00:00.000Z"><i class="fa-solid fa-spinner fa-spin"></i></div></div><div class="webinfo-item"><div class="item-name">本站访客数 :</div><div class="item-count" id="busuanzi_value_site_uv"><i class="fa-solid fa-spinner fa-spin"></i></div></div><div class="webinfo-item"><div class="item-name">本站总浏览量 :</div><div class="item-count" id="busuanzi_value_site_pv"><i class="fa-solid fa-spinner fa-spin"></i></div></div><div class="webinfo-item"><div class="item-name">最后更新时间 :</div><div class="item-count" id="last-push-date" data-lastpushdate="2026-09-19T03:53:43.141Z"><i class="fa-solid fa-spinner fa-spin"></i></div></div></div></div></div></div></main><footer id="footer"><div class="footer-other"><div class="footer-copyright"><span class="copyright">©2025 - 2026 By 红烧花园宝宝</span><span class="framework-info"><span>框架 </span><a target="_blank" rel="noopener" href="https://hexo.io">Hexo 7.3.0</a><span class="footer-separator">|</span><span>主题 </span><a target="_blank" rel="noopener" href="https://github.com/jerryc127/hexo-theme-butterfly">Butterfly 5.4.0-b2</a></span></div></div></footer></div><div id="rightside"><div id="rightside-config-hide"><button id="darkmode" type="button" title="日间和夜间模式切换"><i class="fas fa-adjust"></i></button><button id="hide-aside-btn" type="button" title="单栏和双栏切换"><i class="fas fa-arrows-alt-h"></i></button></div><div id="rightside-config-show"><button id="rightside-config" type="button" title="设置"><i class="fas fa-cog fa-spin"></i></button><button id="go-up" type="button" title="回到顶部"><span class="scroll-percent"></span><i class="fas fa-arrow-up"></i></button></div></div><div><script src="/js/utils.js"></script><script src="/js/main.js"></script><script src="https://cdn.jsdelivr.net/npm/medium-zoom/dist/medium-zoom.min.js"></script><div class="js-pjax"><script>window.typedJSFn = {
init: str => {
window.typed = new Typed('#subtitle', Object.assign({
strings: str,
startDelay: 300,
typeSpeed: 150,
loop: true,
backSpeed: 50,
}, null))
},
run: subtitleType => {
if (true) {
if (typeof Typed === 'function') {
subtitleType()
} else {
btf.getScript('https://cdn.jsdelivr.net/npm/typed.js/dist/typed.umd.min.js').then(subtitleType)
}
} else {
subtitleType()
}
},
processSubtitle: (content, extraContents = []) => {
if (true) {
const sub = ["生命只有一次 , 只能爱你一世"].slice()
if (extraContents.length > 0) {
sub.unshift(...extraContents)
}
if (typeof content === 'string') {
sub.unshift(content)
} else if (Array.isArray(content)) {
sub.unshift(...content)
}
sub.length > 0 && typedJSFn.init(sub)
} else {
document.getElementById('subtitle').textContent = typeof content === 'string' ? content :
(Array.isArray(content) && content.length > 0 ? content[0] : '')
}
}
}
btf.addGlobalFn('pjaxSendOnce', () => { typed.destroy() }, 'typedDestroy')
</script><script>function subtitleType () {
typedJSFn.processSubtitle(["生命只有一次 , 只能爱你一世"])
}
typedJSFn.run(subtitleType)</script></div><script defer="" src="/js/bubble.js"></script><script src="/styles/fish.js"></script><script id="click-heart" src="https://cdn.jsdelivr.net/npm/butterfly-extsrc/dist/click-heart.min.js" async="async" mobile="false"></script><script async="" data-pjax="" src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script><div id="local-search"><div class="search-dialog"><nav class="search-nav"><span class="search-dialog-title">搜索</span><span id="loading-status"></span><button class="search-close-button"><i class="fas fa-times"></i></button></nav><div class="text-center" id="loading-database"><i class="fas fa-spinner fa-pulse"></i><span> 数据加载中</span></div><div class="search-wrap"><div id="local-search-input"><div class="local-search-box"><input class="local-search-box--input" placeholder="搜索文章" type="text"></div></div><hr><div id="local-search-results"></div><div id="local-search-stats-wrap"></div></div></div><div id="search-mask"></div><script src="/js/search/local-search.js"></script></div></div><script src="/live2dw/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script><script>L2Dwidget.init({"tagMode":false,"debug":false,"model":{"jsonPath":"/live2dw/assets/koharu.model.json"},"display":{"position":"left","width":150,"height":300},"mobile":{"show":false},"log":false,"pluginJsPath":"lib/","pluginModelPath":"assets/","pluginRootPath":"live2dw/"});</script></body></html>