From 77ff733f3ee7532ebfcd43fbc7d19b500f0947ea Mon Sep 17 00:00:00 2001 From: JoyChou Date: Wed, 6 Sep 2017 17:45:41 +0800 Subject: [PATCH] add readme --- ...Maven__commons_codec_commons_codec_1_6.xml | 13 ++ ..._commons_logging_commons_logging_1_1_3.xml | 13 ++ ..._apache_httpcomponents_fluent_hc_4_3_6.xml | 13 ++ ...apache_httpcomponents_httpclient_4_3_6.xml | 13 ++ ...g_apache_httpcomponents_httpcore_4_3_3.xml | 13 ++ .idea/workspace.xml | 216 ++++++++++++------ README.md | 32 +-- pom.xml | 7 + src/main/java/security.java | 4 +- src/main/java/test.java | 13 +- target/classes/security.class | Bin 3890 -> 0 bytes target/classes/test.class | Bin 981 -> 0 bytes trident.iml | 5 + 13 files changed, 254 insertions(+), 88 deletions(-) create mode 100644 .idea/libraries/Maven__commons_codec_commons_codec_1_6.xml create mode 100644 .idea/libraries/Maven__commons_logging_commons_logging_1_1_3.xml create mode 100644 .idea/libraries/Maven__org_apache_httpcomponents_fluent_hc_4_3_6.xml create mode 100644 .idea/libraries/Maven__org_apache_httpcomponents_httpclient_4_3_6.xml create mode 100644 .idea/libraries/Maven__org_apache_httpcomponents_httpcore_4_3_3.xml delete mode 100644 target/classes/security.class delete mode 100644 target/classes/test.class diff --git a/.idea/libraries/Maven__commons_codec_commons_codec_1_6.xml b/.idea/libraries/Maven__commons_codec_commons_codec_1_6.xml new file mode 100644 index 0000000..e8a6a9f --- /dev/null +++ b/.idea/libraries/Maven__commons_codec_commons_codec_1_6.xml @@ -0,0 +1,13 @@ + + + + + + + + + + + + + \ No newline at end of file diff --git a/.idea/libraries/Maven__commons_logging_commons_logging_1_1_3.xml b/.idea/libraries/Maven__commons_logging_commons_logging_1_1_3.xml new file mode 100644 index 0000000..01c7b8e --- /dev/null +++ b/.idea/libraries/Maven__commons_logging_commons_logging_1_1_3.xml @@ -0,0 +1,13 @@ + + + + + + + + + + + + + \ No newline at end of file diff --git a/.idea/libraries/Maven__org_apache_httpcomponents_fluent_hc_4_3_6.xml b/.idea/libraries/Maven__org_apache_httpcomponents_fluent_hc_4_3_6.xml new file mode 100644 index 0000000..9773cee --- /dev/null +++ b/.idea/libraries/Maven__org_apache_httpcomponents_fluent_hc_4_3_6.xml @@ -0,0 +1,13 @@ + + + + + + + + + + + + + \ No newline at end of file diff --git a/.idea/libraries/Maven__org_apache_httpcomponents_httpclient_4_3_6.xml b/.idea/libraries/Maven__org_apache_httpcomponents_httpclient_4_3_6.xml new file mode 100644 index 0000000..04cad1e --- /dev/null +++ b/.idea/libraries/Maven__org_apache_httpcomponents_httpclient_4_3_6.xml @@ -0,0 +1,13 @@ + + + + + + + + + + + + + \ No newline at end of file diff --git a/.idea/libraries/Maven__org_apache_httpcomponents_httpcore_4_3_3.xml b/.idea/libraries/Maven__org_apache_httpcomponents_httpcore_4_3_3.xml new file mode 100644 index 0000000..a821fc2 --- /dev/null +++ b/.idea/libraries/Maven__org_apache_httpcomponents_httpcore_4_3_3.xml @@ -0,0 +1,13 @@ + + + + + + + + + + + + + \ No newline at end of file diff --git a/.idea/workspace.xml b/.idea/workspace.xml index 0f140c5..ceecfd0 100644 --- a/.idea/workspace.xml +++ b/.idea/workspace.xml @@ -2,7 +2,14 @@ + + + + + + + @@ -13,14 +20,26 @@ + + + + + - - + + @@ -30,8 +49,8 @@ - - + + @@ -39,11 +58,11 @@ - + - - + + @@ -52,12 +71,14 @@ - + - - - + + + + + @@ -74,6 +95,7 @@ print + dns @@ -87,11 +109,11 @@ @@ -102,10 +124,10 @@ DEFINITION_ORDER - @@ -117,7 +139,7 @@ - Spelling + Android @@ -206,15 +228,15 @@ - + - + - + + + + + + + + - + @@ -693,8 +725,9 @@ - + + @@ -707,38 +740,37 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -756,6 +788,46 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -779,7 +851,9 @@ - + + + @@ -794,19 +868,11 @@ + - - - - - - - - - - - + + @@ -814,8 +880,8 @@ - - + + @@ -824,8 +890,8 @@ - - + + @@ -833,5 +899,15 @@ + + + + + + + + + + \ No newline at end of file diff --git a/README.md b/README.md index 21761e4..0152b4a 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# Trident (三叉戟) +# Trident（三叉戟） > Java Code Security Component （JAVA代码安全组件） @@ -27,16 +27,6 @@ Boolean ret = checkUrl.checkUrlWlist("http://test.joychou.me", urlWList); ## checkSSRF -JAVA默认DNS请求会有30s的缓存，所以默认不存在DNS Rebind问题。除非重新设置TTL为0。 - -如果有大佬能绕过，麻烦提个ISSUE或者PR。 - -我自己测试，以下方法均没绕过。但是，用DNS Rebind方法在调试的时候，均可以测试成功，所以我怀疑设置TTL为0未成功。 - -- DNS Rebind（手动设置JAVA的TTL为0） -- 域名解析2个A记录地址（外网+内网） - - ### 验证逻辑 @@ -52,6 +42,22 @@ JAVA默认DNS请求会有30s的缓存，所以默认不存在DNS Rebind问题。 URL只支持HTTP协议。 ```java -security checkUrl = new security(); -ret = checkUrl.checkSSRF("http://127.0.0.1"); +String url = "http://dns_rebind.joychou.me"; +ret = checkUrl.checkSSRF(url); +if (ret){ + # curl url +} +else { + System.out.println("Bad boy. The url is illegal"); +} ``` + +### 绕过姿势 + + +以上代码在设置TTL为0的情况，可以用以下方法绕过 : + +1. DNS Rebind（手动设置JAVA的TTL为0） +2. 域名解析2个A记录地址（分别为外网和内网） + +也就是说，只要Java不设置TTL为0，该代码逻辑上不存在被绕过风险。 \ No newline at end of file diff --git a/pom.xml b/pom.xml index e15928a..a8c10cc 100644 --- a/pom.xml +++ b/pom.xml @@ -14,5 +14,12 @@ guava 21.0 + + + org.apache.httpcomponents + fluent-hc + 4.3.6 + + \ No newline at end of file diff --git a/src/main/java/security.java b/src/main/java/security.java index 4ee8fcb..c870cbe 100644 --- a/src/main/java/security.java +++ b/src/main/java/security.java @@ -85,7 +85,7 @@ public class security { connection.setUseCaches(false); // 设置为false，手动处理跳转，可以拿到每个跳转的URL connection.setConnectTimeout(3*1000); // 设置连接超时时间为3s //connection.setRequestMethod("GET"); - connection.connect(); // 会解析dns + connection.connect(); // send dns request int responseCode = connection.getResponseCode(); // 发起网络请求 if (responseCode >= 300 && responseCode < 400) { String redirectedUrl = connection.getHeaderField("Location"); @@ -136,7 +136,7 @@ public class security { */ public static String DomainToIP(String domain) throws IOException{ try { - InetAddress IpAddress = InetAddress.getByName(domain); + InetAddress IpAddress = InetAddress.getByName(domain); // send dns request return IpAddress.getHostAddress(); } catch (Exception e) { diff --git a/src/main/java/test.java b/src/main/java/test.java index 4f0284b..cda3bc5 100644 --- a/src/main/java/test.java +++ b/src/main/java/test.java @@ -3,6 +3,7 @@ * Mail: viarus#qq.com * Date: 2017.09.05 */ +import org.apache.http.client.fluent.Request; public class test { public static void main(String[] args) throws Exception { @@ -14,8 +15,14 @@ public class test { System.out.println(ret); // SSRF组件测试 - - ret = checkUrl.checkSSRF("http://127.0.0.1"); - System.out.println(ret); + String url = "http://dns_rebind.joychou.me"; + ret = checkUrl.checkSSRF(url); + if (ret){ + String con = Request.Get(url).execute().returnContent().toString(); + System.out.println(con); + } + else { + System.out.println("Bad boy. The url is illegal"); + } } } diff --git a/target/classes/security.class b/target/classes/security.class deleted file mode 100644 index 1206b8efb282969414da67b730c1b786644a1649..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 3890 zcmb7H3wsn-8GdIknc2w&|=nZ0wx3+sL;vokPO}3+0M># zE!0c3YAaMlE7X<}D|m@Yt1hu9t@m25Kf%WzVtv1vy@ZlJD$m1r&iT$c-{t+@^X=r_ zf4_MPKtKKw#l4tOF&jkymWZPoo`@oYtcF|^Hu9o;QZ!B!1-K%LB94jfxQY`|d=w`& zoRaahh^IuHk;`Z0^3y6l9mNWKM#N`Dd``qOB0jI-3o~`12Y<)lks^G zbn_LQlQZWvydXZm8pYS}bqyCZd_%)GHN2?dTTxuZB@r*F__l_ZqfE|H@rsJe3hExP za+bSYL9nxHpMua%J8ddxN?JK{teBlPoxR3%hMHK?P8pefhGWUPtPHucRzX2DSuj&Y z$8t{&DQHN|nyDuyoy`7>Rd5vyb|#M+$Be#=k(=q8a2+c*Gj#AyRo5cbux)2dBS&M} z@mb3?X-opR!;Au@sG!l`$eC{6>gkhfk!;yldIw zBv=&t8s+|^7xJypD_Pbv8hyre8B3*(A-|k$olBI+o9Og0d#x{hjdKg5gnfp@dkdX<7fD}f|b>H?x=~5 z5^m^N5b+DVspBTL>i8vo#ahX$l&b2ug+nUd((yKatzbnh2p{g@qLoRTEMIetNgYKe zGuWZyH~6iJ-|6_hVDJY4C-7LWjz8iZ6@Sw4F8)kS|7Jdv{sC?V`?n5=yx)^s?o;s> z9e>5&bo^cL^YgdtzQpco{&c&?v0Xc5XF5#Bv7NyV#$G84cWdG9o<2&R^06+(A~vXc z@}Xi&!Sc?I+z8k0Iy9dWQWsnzjnn_`_Z= z{ea(sC7RrA#JTpw=F0*Gg!-2rVRcpHY=-@BPy=GwMmY1~wpzCTwK? zmT{V&STg!43@~u;<12!8X1|iBR-+ednbJB;;4b$1^}MkTv)sv|6FGEw>5f3b#Y3#r-ZT3>Lle!>J-GhfX3-L}E4`Ua12?9P&o%}0c1PMYEkzWz+3C^cEdJ%Uo zpg9?jwRpLOL-X+k#728+>z)NHo96{Ti8TxcEM1tzYh>A)S)En}u!hy>U?rqJ9c3td z_hGJ+41`qU=~2!C7~`oBHBAg@H}-HQ)ywi;9d|BvkJ9OKqCB>#gjOQ%0W3A`VNFYD zdmAf~aZWxYqCMVHzfi);cnKfo|5aN;t)UjB=L&{pd|?iQ@!0AT)(nP~_V88IT|-xU zc=Qddy@`&g8(0^+tAzEW!uk?EQo;r?(SmngeeW!18?PZU=GEI13_ZX!&N1*dJm-x* zEC;v-(UsJqOsR!QwXtd&uovB!B&+uktVapY6ahHE-Gf{`hC{46f9qM(!#Kn0KZ_LY z9--wl&cnn7%y^KFv+|G9+9!ECOb-Q&(|VArZS*inFgL)WkNt%5e3=7M-HT-oT%gY1 z4d6vuk|IRp!-Au*;a?o({B(Eh?h-na@muO;goE?((7*z^w#9=3v2GIN5{6_-U^v|@ zQ{u)a(X^_$`3fSdn%BO@a!}2>Q61y;Sg$u#L)Q=r&L@NO^aN7pFfnXm<}&&i_M)CU z1rp3f1B%q2Acm*-8cy>skf+GuGdzEaH_qa5JniAq&CFHibHL+w8|6Ww5#WBndk4}< zrit@|94n;jXXgB_;t9$8aU$kL#COn_WM-SMCu1$wsg>3etwtB4C$KhQJWuU8#(KU= z_As@FJxldOQQn{2ZuDq>yI-lb?{|*&#P3L@Rf+FPtJ>tvRj*a8yNUj(3RMS4Q`z&` zdIR^o#Z{yh@lN)E3Z5(d$HXiyv8%kqZt*gAUtxTgtC2_eY^9qh)Yc*&DYIrVV$)=% hA9|}TE-LvPOd++}K^Zgfq8lI$a0k;&~P9qkscU0U}QB+Y19pw}% zSWROM>nf_DM^~_+pe8W0ZM$~xR3Kg|?+YZJdGDpboMF3iZ_sT?|Bcyl=*bzLWjgz& zZ-@5CnFu;|pBzRY`$2=ZyQb|5ESBCGN9IRUcTBgfHv`{x+l`3b^xMSe&p8%Qt&X%l zy!9P{w9%K=z_){AlBxsWIWX*gK#jiSoS!1!@jOSGE@A2CpDfu6Y|rg0*reU`2EHYC z?NEIx6j%*4X_!Nnq~ibr+5e>qWRARJtK$u-me(cI*y@t0&hBWQW zDYUUU3AY4=G#RK2R-n>lYAqs1b$NDvK9W%xhQcLWCRXLy6 + + + + + \ No newline at end of file