We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
对于接口/codeinject/host,预期是通过修改host命令注入。
/codeinject/host
host
pom.xml中由于此Commit https://github.com/JoyChou93/java-sec-code/commit/621c30050f82379afe1e2e6d4ff66c1234f33913,本地启动项目的话tomcat是8.5.85 的版本。这个版本的tomcat会对host的格式做检验,对于例如host: localhost;cat /flag的host值,会认为; /这些字符不符合,从而导致打不通。
https://github.com/JoyChou93/java-sec-code/commit/621c30050f82379afe1e2e6d4ff66c1234f33913
8.5.85
host: localhost;cat /flag
;
/
tomcat是8.5.11的话,可以正常打通。
The text was updated successfully, but these errors were encountered:
920bd93
No branches or pull requests
对于接口
/codeinject/host
,预期是通过修改host
命令注入。pom.xml中由于此Commit
https://github.com/JoyChou93/java-sec-code/commit/621c30050f82379afe1e2e6d4ff66c1234f33913
,本地启动项目的话tomcat是8.5.85
的版本。这个版本的tomcat会对host
的格式做检验,对于例如host: localhost;cat /flag
的host
值,会认为;
/
这些字符不符合,从而导致打不通。8.5.85



tomcat是8.5.11的话,可以正常打通。


The text was updated successfully, but these errors were encountered: