Attack Java Web applications [1]

0x00 JavaEE Basics

JSP: The full name is java server page, which is simply a simplified Servlet.

Servlet: Servlet is a server-side Java application that can generate dynamic Web pages.

JavaEE: JavaEE is a new J2EE name. The purpose of renaming is to make it clear that J2EE is only a Java Enterprise Application.

What is Jsp? What is Java? I really want to clarify it! Please don't come up with the following sentence: "I have built a jsp server a few days ago, but it's hard to handle it .".

Let us know what jsp is and what JavaEE is! Java platform structure:

We can see that the Java platform is very huge, and developers are divided:

The reason for listing these two figures is to let you know that the JSP you see is just the tip of the iceberg. Jsp technology is just a necessary technology for Java beginners.

What I want to talk about today is the bottom two layers of the Java tree. It is also something that Junior engineers need to master.

Web requests and the corresponding brief process:

This is a typical process in which the client sends an HTTP request to the server and the server receives, processes, and responds to the request.

If JSP is requested, tomcat will compile our JSP into Servlet, which is a common Java class.

In fact, JSP is a special form of Servlet. Each JSP page is a Servlet instance. Servlet is a common Java class. After compilation, it is a common class file.

This is a common jsp script page, because I only use JSP as the display layer to display simple back-end data pages:

We can clearly see that the status of common Jsp in projects is not as important as most of us think, or even dispensable! Because we can use other things to replace JSP as the front-end display layer. Let's take a look at what the page looks like after being compiled into a class:

You will find that you do not understand this class file at all, because it is a bytecode file that we cannot read at all. After our TOMCAT compilation, he programmed a Java class file and saved it to the Tomcat work directory.

File directory:C: apache-tomcat-7.0.34workCatalinalocalhost your project name orgapachejsp

You just need to open index_jsp.java or open it with jd-gui (Java decompilation tool:

Does someone say this is a Servlet? Of course.

Inherit from the HttpJspBase class, which is actually a subclass of HttpServlet (jasper is the jsp engine of tomcat ).

Jsp has a better display than Servlet. It is difficult for many beginners to separate views from logic. For example, the DEMO that was previously written for PHPSQL injection testing:

This Code does not seem to have any major problems. It can also be correctly run. What problems will it have? The reason is very simple. This is a typical demonstration and the business logic is not separated! This is similar to the poorly written Servlet!

After talking about this, many people will think that Servlet is very abstract. Let's create a Servlet:

After the creation is successful, it will automatically write to the web. xml file:

It is actually the path of a ing URL and a class for processing ing. The automatically generated Java class is roughly like this:

Request Response output content:

If you are familiar with PHP, I will not explain it here. After learning about Jsp and Servlet, let's take a very simple look at how Java Web applications run.

Load the web. xml configuration and obtain various information from the configuration to prepare for the WEB application startup.

Science: C: The Web project is deployed by default under the apache-tomcat-7.0.34webapps. Webapps under the folder is your project name, and under the project WebRoot is generally the root directory of the website, WebRoot under the folder WEB-INF is by default not to allow Web access, the nginx configuration does not filter out this directory.

Quickly locate database connection information:

Everyone may be very concerned about where database connections are usually configured?

The answer is:C:apache-tomcat-7.0.34webappswordpressWEB-INFUnder***.xml

Most Spring frameworks are configured in applicationContext:

If the Hibernate framework is used:WebRootWEB-INFhibernate.cfg.xml

Another abnormal configuration method is to directly uninstall the source code:

Tomcat data source (similar to other servers ):

Directory:C:apache-tomcat-7.0.34confcontext.xml、server.xml

Resin Data source:

Path:D: installDev
Esin-pro-4.0.28conf
Esin. conf (resin 3. x is resin. xml)

Other configuration methods, such as reading data from JEECMS. PropertiesConfiguration file, which is very common:

0x01 Tomcat Basics

That's right. This is TOM. I have been dealing with this cat for several years, and TOMCAT is widely used in Java applications.

TOM is a Web application server and Servlet container.

Load Balancing using Apache + Tomcat:

Tomcat quickly locates the website directory:

How to quickly find the installation path of tomcat:

1. No one should understand that the installation path of apache or tomcat is random, so it is normal to find the path. 2. In your/etc/httpd/conf/httpd. conf file, there will be a LoadModule jk_module configuration used to integrate tomcat, then find JkWorkersFile, that is, tomcat configuration, and find the path of. properties. Httpd may also be configured in the path if not found, then go to the apache2confextrahttpd-vhosts to see whether there is a configured domain name binding. 3. in step 2, find the properties configuration file and read it. Find workers. atat_home, which is the tomcat configuration path. 4. You have not succeeded in obtaining the tomcat path. The specific configuration of the domain name is server. xml under conf. 5. You can find the website directory when reading server. xml. 6. If Step 5 is not found, go to the "ROOT" directory in the webapps directory and check that the website is not configured by default. 7. This is the additional popular science knowledge. Listening: If tomcat is enabled for the database, tomcat data sources may be used. The configuration of context. xml and server. xml under conf is not found. If the website has a domain name bound, you can try to ping the domain name and then bring the port for access. The tomcat logon interface may appear. Tomcat does not configure user login by default, so don't waste time here when there is no relevant user configuration in the tomcat-users.xml. 8. If the configuration is not found, find the corresponding properties, xml under the WEB-INF directory under the website directory and under the classes directory (usually properties ). 9. If you have enough trouble, you can read the source code in classess under WEB. XML. 10. Good luck.

Apache quickly locates the website directory:

Common domain name binding:

Add directlyconfhttpd.conf、confextrahttpd-vhosts.conf

Resin quickly locates the website directory:

Resin. conf (resin3.x) and resin. xml (resin4.x) under the conf of resin)

Resin apache Server Load balancer configuration (Excerpted from my previous article)

Apache resin performs load balancing, Resin is used for JAVAWEB support, and APACHE is used for processing static

With PHP requests, RESIN is fast, and the combination of RESIN and apache should be perfect.

Domain name resolution:

Apache httpd. conf:

Need to modify: Include conf/extra/httpd-vhosts.conf (Be sure to remove the previous #, otherwise the configuration does not work)

Common domain name binding:

Directly add to httpd. conf

<VirtualHost *:80>ServerAdmin admin@bjcyw.cn DocumentRoot E:/XXXX/XXXServerName beijingcanyinwang.com ErrorLog E:/XXXX/XXX/bssn-error_log CustomLog E:/XXXX/XXX/bssn_log common </VirtualHost>

To bind a second-level domain name, you must modify the following:

E:installapache2confextrahttpd-vhosts.conf

For example:

<VirtualHost *:80>DocumentRoot E:/XXXXXXX/XXXServerName bbs.beijingcanyinwang.com DirectoryIndex index.html index.php index.htm</VirtualHost>

Resin's

Request Processing:

<LocationMatch (.*?).jsp>SetHandler caucho-request </LocationMatch><LocationMatch (.*?).action> SetHandler caucho-request </LocationMatch><LocationMatch union-resin-stat-davic> SetHandler caucho-request </LocationMatch><LocationMatch stat> SetHandler caucho-request </LocationMatch> <LocationMatch load>SetHandler caucho-request </LocationMatch> <LocationMatch vote> SetHandler caucho-request </LocationMatch>

Added support for Resin in APACHE:

LoadModule caucho_module "E:/install/resin-pro-3.1.12/win32/apache-2.2/mod_caucho. dll"

Add the following at the end:

<IfModule mod_caucho.c> ResinConfigServer localhost 6800 CauchoStatus yes</IfModule>

Only apache can find resin.

PHP support problems:

Resin supports PHP testing 4.0.29 by default. Even if you delete the servlet configuration parsed by PHP, instead, resin 3.1 has no pressure to comment out the servlet configuration of PHP.

After integration: