前面的教程有一章是講解如何突破上傳的,當(dāng)被人通過(guò)上傳功能突破的防線那就杯具了,有點(diǎn)hack知識(shí)的人都知道,很多攻擊都是優(yōu)先尋找上傳的功能,因?yàn)槟芡黄?/p>
就會(huì)剩下很多的功夫,比如hack上傳了一個(gè)asp,php或者jsp文件,然后通過(guò)抓包路徑獲取了文件存放地址,然后直接請(qǐng)求就能通過(guò)這個(gè)可執(zhí)行的文件獲取到數(shù)據(jù)庫(kù)的信息,
或者是遍歷目錄下載文件,尋找文件中的其他漏洞以獲得更高的權(quán)限,下面我就演示下簡(jiǎn)單的防范手段,就算被突破了上傳也會(huì)有下一堵墻在一定程度上防止執(zhí)行腳本
我主要是使用shiro寫(xiě)了一個(gè)filter過(guò)濾需要請(qǐng)求信息,如遇到黑名單則記錄信息,看下面貼的代碼
- package com.silvery.security.shiro.filter;
-
- import java.text.SimpleDateFormat;
- import java.util.Date;
-
- import javax.servlet.ServletRequest;
- import javax.servlet.ServletResponse;
- import javax.servlet.http.HttpServletRequest;
-
- import org.apache.shiro.web.filter.authz.AuthorizationFilter;
- import org.slf4j.Logger;
- import org.slf4j.LoggerFactory;
-
- import com.silvery.utils.PatternUtils;
- import com.silvery.utils.WebUtils;
-
- /**
- *
- * 黑名單可執(zhí)行程序請(qǐng)求過(guò)濾器
- *
- * @author shadow
- *
- */
- public class SimpleExecutiveFilter extends AuthorizationFilter {
-
- protected static final String[] blackUrlPathPattern = new String[] { "*.aspx*", "*.asp*", "*.php*", "*.exe*",
- "*.jsp*", "*.pl*", "*.py*", "*.groovy*", "*.sh*", "*.rb*", "*.dll*", "*.bat*", "*.bin*", "*.dat*",
- "*.bas*", "*.c*", "*.cmd*", "*.com*", "*.cpp*", "*.jar*", "*.class*", "*.lnk*" };
-
- private static final Logger log = LoggerFactory.getLogger(SimpleExecutiveFilter.class);
-
- @Override
- protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object obj) throws Exception {
-
- HttpServletRequest httpRequest = (HttpServletRequest) request;
-
- String reqUrl = httpRequest.getRequestURI().toLowerCase().trim();
-
- for (String pattern : blackUrlPathPattern) {
- if (PatternUtils.simpleMatch(pattern, reqUrl)) {
- log.error(new StringBuffer().append("unsafe request >>> ").append(" request time: ").append(
- new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").format(new Date())).append("; request ip: ")
- .append(WebUtils.getClientIP()).append("; request url: ").append(httpRequest.getRequestURI())
- .toString());
- return false;
- }
- }
-
- return true;
-
- }
-
- }
下一步把剛剛寫(xiě)的過(guò)濾器配置到shiro的過(guò)濾鏈中
- <!-- 過(guò)濾鏈配置 -->
- <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
- <property name="securityManager" ref="securityManager" />
- <property name="loginUrl" value="/" />
- <property name="successUrl" value="/cms/index.do" />
- <property name="unauthorizedUrl" value="/static/unauthorized.html" />
- <property name="filters">
- <map>
- <entry key="role">
- <bean
- class="com.silvery.security.shiro.filter.SimpleRoleAuthorizationFilter" />
- </entry>
- <entry key="authc">
- <bean
- class="com.silvery.security.shiro.filter.SimpleFormAuthenticationFilter" />
- </entry>
- <entry key="exec">
- <bean class="com.silvery.security.shiro.filter.SimpleExecutiveFilter" />
- </entry>
- </map>
- </property>
- </bean>
最后配置下我們需要過(guò)濾的請(qǐng)求目錄,一般都是全量過(guò)濾,但是有些靜態(tài)資源是不應(yīng)該過(guò)濾的,所以應(yīng)該注意順序,讓anon權(quán)限的放到放到exec的前面
- <!-- 權(quán)限資源配置 -->
- <bean id="filterChainDefinitionsService"
- class="com.silvery.security.shiro.service.impl.SimpleFilterChainDefinitionsService">
- <property name="definitions">
- <value>
- /static/** = anon
- /** = exec
- </value>
- </property>
- </bean>
最后請(qǐng)求下php,jsp等那些文件是返回到無(wú)權(quán)限的頁(yè)面,我們的簡(jiǎn)單防范已經(jīng)達(dá)到目的了,下一章節(jié)可能講如何防范xss和csrf攻擊的防范
本站僅提供存儲(chǔ)服務(wù)，所有內(nèi)容均由用戶發(fā)布，如發(fā)現(xiàn)有害或侵權(quán)內(nèi)容，請(qǐng)
點(diǎn)擊舉報(bào)。
