漏洞检测

区分 Fastjson 和 Jackson

{"name":"S","age":21}

和

{"name":"S","age":21,"agsbdkjada__ss_d":123}

我们向这个地址POST一个JSON对象，即可更新服务端的信息：

curl http://your-ip:8090/ -H "Content-Type: application/json" --data '{"name":"hello", "age":20}'

复现

安装mvn

mkdir -p /server/tools

cd /server/tools/

wget https://mirrors.cnnic.cn/apache/maven/maven-3/3.5.4/binaries/apache-maven-3.5.4-bin.tar.gz --no-check-certificate

tar -xf apache-maven-3.5.4-bin.tar.gz

mv apache-maven-3.5.4 /usr/local/maven

ln -s /usr/local/maven/bin/mvn /usr/bin/mvn

echo " ">>/etc/profile

echo "# Made for mvn env by zhaoshuai on $(date +%F)">>/etc/profile

echo 'export MAVEN_HOME=/usr/local/maven'>>/etc/profile

echo 'export PATH=$MAVEN_HOME/bin:$PATH'>>/etc/profile

source /etc/profile

echo $PATH

mvn -version