Java files contain two types of dynamically contained static inclusions:
Static include:<%@include file= "top.jsp"%>
Dynamic include:<jsp: include page= "top.jsp" />
I will not dwell on the difference between the two.
There is no problem with knowing that static inclusions are present, because file parameters cannot be dynamically assigned
and dynamic inclusion is problematic.
We often say PHP files contain both local file contains and remote files contain two
So I analyze the Java file contains the time is divided between the two cases
1. The local file contains:
At present, my understanding of Java's local file contains: The damage is only the file read, in general, can not cause command execution or code execution. PHP is able to execute the command because it contains TXT file, as long as the content of the TXT type in accordance with the PHP program can be interpreted as PHP, that is, the attacker may upload a word trojan suffix is txt, upload after the use of the file contains the vulnerability to include him. Java does not have a secondary feature. So personally think that Java's local file contains the vulnerability is difficult to create code execution of the vulnerability (of course, if directly include a word trojan JSP file can still execute commands, if there is such a Trojan JSP file, you know the path, why do not know the access? ), there is a special case is, by some means on the server generated a word trojan file but in the features folder, access permissions are insufficient when you can use this file contains the vulnerability contains her.
Html>
<title> test Page</title>
<body>
Static inclusions
top.jsp file
<%@IncludeFile= "top.jsp"%>
<%@IncludeFile= "Pass.txt"%>
<%@IncludeFile= "Web-inf/web.xml"%>
<%String name = Request.getparameter ("Name");%>
Dynamic inclusion
<Jsp: IncludePage= "Top.jsp"/>
<Jsp: IncludePage= "Pass.txt" />
<jsp: include page= "Web-inf/web.xml" />
<jsp: include page= "http://www.njuae.cn/index.jsp" />
<%--<jsp:include page= "<%=name%>"/>--%>
<%--<jsp:include page= "Oneword.txt"/>--%>
</body>
2. Remote file contains:
Tested discovery<JSP: Include page= "http://www.njuae.cn/index.jsp"/> Can normally contain files, but the runtime will be error, do not know why, and later research, it seems that there should be no such loophole.
Java file contains a vulnerability
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
