");
out.println("
SQL Query:
");
out.println("
");
@@ -66,68 +61,111 @@ public static void executeQuery(String sql, ServletContext application, HttpServ
stmt = con.prepareStatement(sql);
logger.info("Created PreparedStatement: " + sql);
- executePreparedStatement(stmt, fetchSize, rs, sql, out, allResults, showOutput);
+ if (setString){
+ stmt.setString(1, "something");
+ logger.info("Substituted parameter in PreparedStatement: " + sql);
+ }
+ executePreparedStatement(stmt, fetchSize, sql, out, allResults, showOutput);
} catch(SQLException sqlexception) {
verifySQLException(sqlexception, application, response, out);
} finally {
- cleanup(rs, stmt, con);
+ cleanup(stmt, con);
TagUtil.printPageFooter(out);
out.close();
}
}
- public static void executeQuerySetString(String sql, ServletContext application, HttpServletRequest request, HttpServletResponse response, Boolean showErrors, Boolean allResults, Boolean showOutput) throws IOException {
- response.setHeader("Content-Type", "text/html;charset=UTF-8");
- ServletOutputStream out = response.getOutputStream();
- String connectionType = null;
- Connection con = null;
- int fetchSize = ((Integer) application.getAttribute(Constants.JDBC_FETCH_SIZE)).intValue();
- String defaultConnection = (String) application.getAttribute(Constants.DEFAULT_CONNECTION);
+ public static void executeQuery(
+ String sql, ServletContext application, HttpServletRequest request, HttpServletResponse response, Boolean showErrors, Boolean allResults, Boolean showOutput)
+ throws IOException
+ {
+ boolean setString = false;
+ executeQuery(sql, application, request, response, showErrors, allResults, showOutput, setString);
+ }
- PreparedStatement stmt = null;
- ResultSet rs = null;
+ public static void executeQuery(
+ String sql, ServletContext application, HttpServletRequest request, HttpServletResponse response)
+ throws IOException
+ {
+ executeQuery(sql, application, request, response, Boolean.TRUE, Boolean.TRUE, Boolean.TRUE);
+ }
- TagUtil.printPageHead(out);
- TagUtil.printPageNavbar(out);
- TagUtil.printContentDiv(out);
+ public static void executeQuerySetString(String sql, ServletContext application, HttpServletRequest request, HttpServletResponse response, Boolean showErrors, Boolean allResults, Boolean showOutput) throws IOException {
+ boolean setString = true;
+ executeQuery(sql, application, request, response, showErrors, allResults, showOutput, setString);
+ }
+ public static ArrayList executeQueryWithoutNewPage(String sql, ServletContext application, HttpServletRequest request)
+ throws IOException, SQLException
+ {
+ Connection con = null;
+ PreparedStatement stmt = null;
+ ArrayList resultList;
try {
- //Checking if connectionType is set, defaulting it to c3p0 if not set.
- if(request.getParameter("connectionType") == null) {
- connectionType = defaultConnection;
- } else {
- connectionType = request.getParameter("connectionType");
- }
- con = ConnectionUtil.getConnection(application, connectionType);
- out.println("");
- out.println("
SQL Query:
");
- out.println("
");
- out.println(sql);
- out.println("");
-
+ con = ConnectionUtil.getConnection(application, request);
logger.info(sql);
-
stmt = con.prepareStatement(sql);
logger.info("Created PreparedStatement: " + sql);
- stmt.setString(1, "something");
- logger.info("Substituted parameter in PreparedStatement: " + sql);
- executePreparedStatement(stmt, fetchSize, rs, sql, out, allResults, showOutput);
- } catch(SQLException sqlexception) {
- verifySQLException(sqlexception, application, response, out);
+ ResultSet rs = executePreparedStatementWithoutWriting(stmt, getFetchSize(application).intValue(), sql);
+ resultList = convertResultSetToList(rs);
} finally {
- cleanup(rs, stmt, con);
- TagUtil.printPageFooter(out);
- out.close();
+ cleanup(stmt, con);
}
+ return resultList;
}
- private static void executePreparedStatement(PreparedStatement stmt, int fetchSize, ResultSet rs, String sql, ServletOutputStream out, Boolean allResults, Boolean showOutput) throws IOException, SQLException {
- stmt.setFetchSize(fetchSize);
- rs = stmt.executeQuery();
- logger.info("Executed: " + sql);
+ private static Integer getFetchSize(ServletContext application) {
+ return (Integer) application.getAttribute(Constants.JDBC_FETCH_SIZE);
+ }
- writeToResponse(allResults, showOutput, out, rs);
- }
+ private static void executePreparedStatement(PreparedStatement stmt, int fetchSize, String sql, ServletOutputStream out, Boolean allResults, Boolean showOutput)
+ throws IOException, SQLException
+ {
+ boolean shouldWriteToResponse = true;
+ executePreparedStatement(stmt, fetchSize, sql, out, allResults.booleanValue(), showOutput.booleanValue(), shouldWriteToResponse);
+ }
+
+ private static ResultSet executePreparedStatement(
+ PreparedStatement stmt, int fetchSize, String sql, ServletOutputStream out, boolean allResults, boolean showOutput, boolean shouldWriteToResponse)
+ throws IOException, SQLException
+ {
+ stmt.setFetchSize(fetchSize);
+ ResultSet rs = stmt.executeQuery();
+ logger.info("Executed: " + sql);
+
+ if (shouldWriteToResponse)
+ {
+ writeToResponse(new Boolean(allResults), new Boolean(showOutput), out, rs);
+ }
+ return rs;
+ }
+
+ private static ResultSet executePreparedStatementWithoutWriting(PreparedStatement stmt, int fetchSize, String sql)
+ throws IOException, SQLException
+ {
+ ServletOutputStream out = null;
+ boolean allResults = false;
+ boolean showOutput = false;
+ boolean shouldWriteToResponse = false;
+
+ return executePreparedStatement(stmt, fetchSize, sql, out, allResults, showOutput, shouldWriteToResponse);
+ }
+
+ private static ArrayList convertResultSetToList(ResultSet rs) throws SQLException
+ {
+ ArrayList resultList = new ArrayList();
+ int columnCount = rs.getMetaData().getColumnCount();
+ while (rs.next())
+ {
+ ArrayList resultRow = new ArrayList();
+ for (int i = 1; i <= columnCount; i++)
+ {
+ resultRow.add(rs.getObject(i));
+ }
+ resultList.add(resultRow);
+ }
+ return resultList;
+ }
private static void writeToResponse(Boolean allResults, Boolean showOutput, ServletOutputStream out, ResultSet rs) throws SQLException, IOException {
ResultSetMetaData metaData = rs.getMetaData();
@@ -170,69 +208,55 @@ private static void writeRow(ServletOutputStream out, ResultSet rs, ResultSetMet
out.println("");
}
- private static void verifySQLException(SQLException sqlexception, ServletContext application, HttpServletResponse response, ServletOutputStream out) throws IOException{
- if(sqlexception.getMessage().equals("Attempted to execute a query with one or more bad parameters.")) {
- int error = Integer.parseInt((String) application.getAttribute("defaultError"));
- response.setStatus(error);
- } else {
- response.setStatus(500);
- }
-
- out.println("
");
- out.println("
SQLException: " + sqlexception.getMessage() + "
");
-
- if(logger.isDebugEnabled()) {
- logger.debug(sqlexception.getMessage(), sqlexception);
- } else {
- logger.error(sqlexception);
- }
-
- while((sqlexception = sqlexception.getNextException()) != null) {
- out.println(sqlexception.getMessage() + "
");
- }
- }
-
- private static void cleanup(ResultSet rs, PreparedStatement stmt, Connection con) throws IOException{
- try {
- if(rs != null) {
- logger.info("Closing ResultSet " + rs);
- rs.close();
- logger.info("Closed ResultSet " + rs);
- }
- } catch (SQLException rsCloseException) {
- if(logger.isDebugEnabled()) {
- logger.debug(rsCloseException.getMessage(), rsCloseException);
- } else {
- logger.error(rsCloseException);
- }
- }
-
- try {
- if(stmt != null) {
- logger.info("Closing PreparedStatement " + stmt);
- stmt.close();
- logger.info("Closed PreparedStatement " + stmt);
- }
- } catch (SQLException stmtCloseException) {
- if(logger.isDebugEnabled()) {
- logger.debug(stmtCloseException.getMessage(), stmtCloseException);
- } else {
- logger.error(stmtCloseException);
- }
- }
-
- try {
- if(con != null) {
- logger.info("Closing Connection " + con);
- con.close();
- logger.info("Closed Connection " + con);
- }
- } catch (SQLException conCloseException) {
- if(logger.isDebugEnabled()) {
- logger.debug(conCloseException.getMessage(), conCloseException);
- } else {
- logger.error(conCloseException);
- }
- }
+ public static void verifySQLException(SQLException sqlexception, ServletContext application, HttpServletResponse response, ServletOutputStream out) throws IOException{
+ if(sqlexception.getMessage().equals("Attempted to execute a query with one or more bad parameters.")) {
+ int error = Integer.parseInt((String) application.getAttribute("defaultError"));
+ response.setStatus(error);
+ } else {
+ response.setStatus(500);
+ }
+
+ out.println("
");
+ out.println("
SQLException: " + sqlexception.getMessage() + "
");
+
+ if(logger.isDebugEnabled()) {
+ logger.debug(sqlexception.getMessage(), sqlexception);
+ } else {
+ logger.error(sqlexception);
+ }
+
+ while((sqlexception = sqlexception.getNextException()) != null) {
+ out.println(sqlexception.getMessage() + "
");
+ }
+ }
+
+ public static void cleanup(PreparedStatement stmt, Connection con) {
+ try {
+ if(stmt != null) {
+ logger.info("Closing PreparedStatement " + stmt);
+ stmt.close();
+ logger.info("Closed PreparedStatement " + stmt);
+ }
+ } catch (SQLException stmtCloseException) {
+ if(logger.isDebugEnabled()) {
+ logger.debug(stmtCloseException.getMessage(), stmtCloseException);
+ } else {
+ logger.error(stmtCloseException);
+ }
+ }
+
+ try {
+ if(con != null) {
+ logger.info("Closing Connection " + con);
+ con.close();
+ logger.info("Closed Connection " + con);
+ }
+ } catch (SQLException conCloseException) {
+ if(logger.isDebugEnabled()) {
+ logger.debug(conCloseException.getMessage(), conCloseException);
+ } else {
+ logger.error(conCloseException);
+ }
+ }
}
}
diff --git a/src/main/java/com/waratek/spiracle/sql/util/UpdateUtil.java b/src/main/java/com/waratek/spiracle/sql/util/UpdateUtil.java
index 9f70f61..206dab9 100644
--- a/src/main/java/com/waratek/spiracle/sql/util/UpdateUtil.java
+++ b/src/main/java/com/waratek/spiracle/sql/util/UpdateUtil.java
@@ -33,7 +33,6 @@ public class UpdateUtil {
public static void executeUpdate(String sql, ServletContext application, HttpServletRequest request, HttpServletResponse response) throws IOException{
response.setHeader("Content-Type", "text/html;charset=UTF-8");
ServletOutputStream out = response.getOutputStream();
- String connectionType = null;
Connection con = null;
PreparedStatement stmt = null;
@@ -43,13 +42,7 @@ public static void executeUpdate(String sql, ServletContext application, HttpSer
TagUtil.printContentDiv(out);
try {
- //Checking if connectionType is not, defaulting it to c3p0 if not set.
- if(request.getParameter("connectionType") == null) {
- connectionType = "c3p0";
- } else {
- connectionType = request.getParameter("connectionType");
- }
- con = ConnectionUtil.getConnection(application, connectionType);
+ con = ConnectionUtil.getConnection(application, request);
out.println("
");
out.println("
SQL Query:
");
out.println("
");
@@ -66,53 +59,31 @@ public static void executeUpdate(String sql, ServletContext application, HttpSer
out.println("Altered Rows:
");
out.print("" + result + "
");
} catch(SQLException e) {
- if(e.getMessage().equals("Attempted to execute a query with one or more bad parameters.")) {
- int error = Integer.parseInt((String) application.getAttribute("defaultError"));
- response.setStatus(error);
- } else {
- response.setStatus(500);
- }
- out.println("");
- out.println("SQLException: " + e.getMessage() + "
");
- if(logger.isDebugEnabled()) {
- logger.debug(e.getMessage(), e);
- } else {
- logger.error(e);
- }
- while((e = e.getNextException()) != null) {
- out.println(e.getMessage() + "
");
- }
+ SelectUtil.verifySQLException(e, application, response, out);
} finally {
- try {
- if(stmt != null) {
- logger.info("Closing PreparedStatement " + stmt);
- stmt.close();
- logger.info("Closed PreparedStatement " + stmt);
- }
- } catch (SQLException stmtCloseException) {
- if(logger.isDebugEnabled()) {
- logger.debug(stmtCloseException.getMessage(), stmtCloseException);
- } else {
- logger.error(stmtCloseException);
- }
- }
- try {
- if(con != null) {
- logger.info("Closing Connection " + con);
- con.close();
- logger.info("Closed Connection " + con);
- }
- } catch (SQLException conCloseException) {
- if(logger.isDebugEnabled()) {
- logger.debug(conCloseException.getMessage(), conCloseException);
- } else {
- logger.error(conCloseException);
- }
- }
+ SelectUtil.cleanup(stmt, con);
out.println("
");
TagUtil.printPageFooter(out);
out.close();
}
}
+
+ public static void executeUpdateWithoutNewPage(String sql, ServletContext application, HttpServletRequest request)
+ throws SQLException
+ {
+ PreparedStatement stmt = null;
+ Connection con = null;
+ try {
+ con = ConnectionUtil.getConnection(application, request);
+ logger.info(sql);
+ stmt = con.prepareStatement(sql);
+ logger.info("Created PreparedStatement: " + sql);
+ int result = stmt.executeUpdate();
+ logger.info("Executed: " + sql);
+ logger.info("Query result: " + result);
+ } finally {
+ SelectUtil.cleanup(stmt, con);
+ }
+ }
}
diff --git a/src/main/java/com/waratek/spiracle/xss/HelloUserTag.java b/src/main/java/com/waratek/spiracle/xss/HelloUserTag.java
new file mode 100755
index 0000000..7aba92b
--- /dev/null
+++ b/src/main/java/com/waratek/spiracle/xss/HelloUserTag.java
@@ -0,0 +1,35 @@
+package com.waratek.spiracle.xss;
+
+import javax.servlet.jsp.tagext.*;
+import javax.servlet.jsp.*;
+import java.io.*;
+
+public class HelloUserTag extends SimpleTagSupport {
+
+ private String username;
+ private StringWriter sw = new StringWriter();
+
+ public void setUsername(String name) {
+ this.username = name;
+ }
+
+ public void doTag() throws JspException, IOException {
+ JspWriter out = getJspContext().getOut();
+ getJspBody().invoke(sw);
+
+ out.println("Hello Spiracle user: " + username + "!");
+ out.println("
");
+
+ JspWriter oldout;
+ do {
+ oldout = getJspContext().getOut();
+ out = getJspContext().popBody();
+ } while (oldout != out);
+
+ out.print("Welcome to Spiracle");
+ out.write(", an insecure web application used to test system security controls.".toCharArray());
+ out.println("
");
+
+ getJspContext().getOut().println(sw.toString());
+ }
+}
\ No newline at end of file
diff --git a/src/main/java/com/waratek/spiracle/xss/ReadHTML.java b/src/main/java/com/waratek/spiracle/xss/ReadHTML.java
index 62256bf..c8bfff5 100644
--- a/src/main/java/com/waratek/spiracle/xss/ReadHTML.java
+++ b/src/main/java/com/waratek/spiracle/xss/ReadHTML.java
@@ -7,6 +7,8 @@
import javax.servlet.ServletOutputStream;
import javax.servlet.ServletRequest;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpSession;
public class ReadHTML {
@@ -14,14 +16,14 @@ static void readHTML(Object out, String taintedInput, ServletRequest req)
throws IOException {
String line = "";
String XSS = "XSS";
- String htmlFile = req.getRealPath("/") + "xss.html";
+ String htmlFile = ((HttpServletRequest) req).getSession().getServletContext().getRealPath("/") + "xss.html";
BufferedReader in = new BufferedReader(new FileReader(htmlFile));
while ((line = in.readLine()) != null) {
if (line.indexOf(XSS) != -1) {
System.out.println("Transforming:");
System.out.println(line);
- line = line.replaceAll(XSS, taintedInput);
+ line = line.replace(XSS, taintedInput);
System.out.println(line);
}
diff --git a/src/main/java/com/waratek/spiracle/xss/XSSWebAppHSRPW.java b/src/main/java/com/waratek/spiracle/xss/XSSWebAppHSRPW.java
index bb65383..4a60b59 100644
--- a/src/main/java/com/waratek/spiracle/xss/XSSWebAppHSRPW.java
+++ b/src/main/java/com/waratek/spiracle/xss/XSSWebAppHSRPW.java
@@ -4,12 +4,10 @@
import java.io.PrintWriter;
import javax.servlet.ServletException;
-
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-
public class XSSWebAppHSRPW extends HttpServlet {
public void doGet(HttpServletRequest req, HttpServletResponse res)
@@ -19,7 +17,6 @@ public void doGet(HttpServletRequest req, HttpServletResponse res)
ReadHTML.readHTML(out, req.getParameter("taintedtext"), req);
}
-
protected void doPost(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
doGet(req, resp);
diff --git a/src/main/java/com/waratek/spiracle/xss/XSSWebAppHSRSOS.java b/src/main/java/com/waratek/spiracle/xss/XSSWebAppHSRSOS.java
index 09275e2..21e82c2 100644
--- a/src/main/java/com/waratek/spiracle/xss/XSSWebAppHSRSOS.java
+++ b/src/main/java/com/waratek/spiracle/xss/XSSWebAppHSRSOS.java
@@ -4,12 +4,10 @@
import javax.servlet.ServletException;
import javax.servlet.ServletOutputStream;
-
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-
public class XSSWebAppHSRSOS extends HttpServlet {
public void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
@@ -18,7 +16,6 @@ public void doGet(HttpServletRequest req, HttpServletResponse res) throws Servle
ReadHTML.readHTML(out, req.getParameter("taintedtext"), req);
}
-
protected void doPost(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
doGet(req, resp);
diff --git a/src/main/java/com/waratek/spiracle/xss/XSSWebAppHSRSOSDelay.java b/src/main/java/com/waratek/spiracle/xss/XSSWebAppHSRSOSDelay.java
index bfe30d8..c86c677 100644
--- a/src/main/java/com/waratek/spiracle/xss/XSSWebAppHSRSOSDelay.java
+++ b/src/main/java/com/waratek/spiracle/xss/XSSWebAppHSRSOSDelay.java
@@ -4,12 +4,10 @@
import javax.servlet.ServletException;
import javax.servlet.ServletOutputStream;
-
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-
public class XSSWebAppHSRSOSDelay extends HttpServlet {
public void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
@@ -23,7 +21,6 @@ public void doGet(HttpServletRequest req, HttpServletResponse res) throws Servle
ReadHTML.readHTML(out, req.getParameter("taintedtext"), req);
}
-
protected void doPost(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
doGet(req, resp);
diff --git a/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRPW.java b/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRPW.java
index 4153261..35508fd 100644
--- a/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRPW.java
+++ b/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRPW.java
@@ -6,22 +6,18 @@
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
-
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-
public class XSSWebAppSRPW extends HttpServlet {
-
public void service(ServletRequest req, ServletResponse res) throws ServletException, IOException {
res.setContentType("text/html");
PrintWriter out = res.getWriter();
ReadHTML.readHTML(out, req.getParameter("taintedtext"), req);
}
-
protected void doPost(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
doGet(req, resp);
diff --git a/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRPWDelay.java b/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRPWDelay.java
index f8e4432..242bc29 100644
--- a/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRPWDelay.java
+++ b/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRPWDelay.java
@@ -7,15 +7,12 @@
import javax.servlet.ServletOutputStream;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
-
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-
public class XSSWebAppSRPWDelay extends HttpServlet {
-
public void service(ServletRequest req, ServletResponse res) throws ServletException, IOException {
try {
Thread.sleep(10000);
@@ -27,7 +24,6 @@ public void service(ServletRequest req, ServletResponse res) throws ServletExcep
ReadHTML.readHTML(out, req.getParameter("taintedtext"), req);
}
-
protected void doPost(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
doGet(req, resp);
diff --git a/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRSOS.java b/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRSOS.java
index 1d30f1e..8a1c258 100644
--- a/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRSOS.java
+++ b/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRSOS.java
@@ -6,22 +6,18 @@
import javax.servlet.ServletOutputStream;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
-
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-
public class XSSWebAppSRSOS extends HttpServlet {
-
public void service(ServletRequest req, ServletResponse res) throws ServletException, IOException {
res.setContentType("text/html");
ServletOutputStream out = res.getOutputStream();
ReadHTML.readHTML(out, req.getParameter("taintedtext"), req);
}
-
protected void doPost(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
doGet(req, resp);
diff --git a/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRSOSDelay.java b/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRSOSDelay.java
index 3fef19b..442e10a 100644
--- a/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRSOSDelay.java
+++ b/src/main/java/com/waratek/spiracle/xss/XSSWebAppSRSOSDelay.java
@@ -6,15 +6,12 @@
import javax.servlet.ServletOutputStream;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
-
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-
public class XSSWebAppSRSOSDelay extends HttpServlet {
-
public void service(ServletRequest req, ServletResponse res) throws ServletException, IOException {
try {
Thread.sleep(10000);
@@ -26,7 +23,6 @@ public void service(ServletRequest req, ServletResponse res) throws ServletExcep
ReadHTML.readHTML(out, req.getParameter("taintedtext"), req);
}
-
protected void doPost(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
doGet(req, resp);
diff --git a/src/main/webapp/WEB-INF/custom.tld b/src/main/webapp/WEB-INF/custom.tld
new file mode 100755
index 0000000..d0085ea
--- /dev/null
+++ b/src/main/webapp/WEB-INF/custom.tld
@@ -0,0 +1,15 @@
+
+ 1.0
+ 2.0
+ Waratek
+
+
+ HelloUser
+ com.waratek.spiracle.xss.HelloUserTag
+ scriptless
+
+ username
+ true
+
+
+
\ No newline at end of file
diff --git a/src/main/webapp/conf/Spiracle.properties b/src/main/webapp/conf/Spiracle.properties
index 81ca0cf..58cec1d 100644
--- a/src/main/webapp/conf/Spiracle.properties
+++ b/src/main/webapp/conf/Spiracle.properties
@@ -1,3 +1,7 @@
+# Spiracle can work with either of the below databases.
+# It is sufficient to install and configure one of them.
+default.connection=c3p0.oracle
+
c3p0.oracle.classname=oracle.jdbc.driver.OracleDriver
c3p0.oracle.url=jdbc:oracle:thin:@localhost:1521:XE
c3p0.oracle.username=test
@@ -10,10 +14,10 @@ c3p0.mysql.username=test
c3p0.mysql.password=test
c3p0.mysql.maxPoolSize=50
-c3p0.mssql.classname=net.sourceforge.jtds.jdbc.Driver
-c3p0.mssql.url=jdbc:sqlserver://localhost:1433
+c3p0.mssql.classname=com.microsoft.sqlserver.jdbc.SQLServerDriver
+c3p0.mssql.url=jdbc:sqlserver://localhost:1433;databaseName=spiracle;encrypt=true;trustServerCertificate=true
c3p0.mssql.username=test
-c3p0.mssql.password=test
+c3p0.mssql.password=Mssql1234
c3p0.mssql.maxPoolSize=50
c3p0.db2.classname=com.ibm.db2.jcc.DB2Driver
@@ -22,18 +26,22 @@ c3p0.db2.username=test
c3p0.db2.password=test
c3p0.db2.maxPoolSize=50
-c3p0.sybase.classname=net.sourceforge.jtds.jdbc.Driver
-c3p0.sybase.url=jdbc:jtds:sybase://localhost:5000/test
+c3p0.sybase.classname=com.sybase.jdbc4.jdbc.SybDriver
+c3p0.sybase.url=jdbc:sybase:Tds:localhost:5000/test
c3p0.sybase.username=sa
c3p0.sybase.password=sybase
c3p0.sybase.maxPoolSize=50
+c3p0.postgres.classname=org.postgresql.Driver
+c3p0.postgres.url=jdbc:postgresql://localhost:5432/test
+c3p0.postgres.username=test
+c3p0.postgres.password=test
+c3p0.postgres.maxPoolSize=50
+
jdbc.fetchsize=25
waratek.error=550
-default.connection=c3p0.oracle
-
spring.path=/path/to/spring-context.xml
application.loggingEnabled=True
diff --git a/src/main/webapp/conf/setupdb_mssql.sql b/src/main/webapp/conf/setupdb_mssql.sql
index 91a7844..14af500 100644
--- a/src/main/webapp/conf/setupdb_mssql.sql
+++ b/src/main/webapp/conf/setupdb_mssql.sql
@@ -1,5 +1,7 @@
create database spiracle;
+use spiracle;
+
DROP TABLE users;
DROP TABLE address;
DROP TABLE TEXT_STORE;
diff --git a/src/main/webapp/conf/setupdb_mysql.sql b/src/main/webapp/conf/setupdb_mysql.sql
index fa44f3b..ba771b8 100644
--- a/src/main/webapp/conf/setupdb_mysql.sql
+++ b/src/main/webapp/conf/setupdb_mysql.sql
@@ -1,11 +1,13 @@
-CREATE USER 'test'@'localhost' IDENTIFIED BY 'test';
+CREATE USER IF NOT EXISTS 'test'@'localhost' IDENTIFIED BY 'test';
GRANT ALL PRIVILEGES ON *.* TO 'test'@'localhost' WITH GRANT OPTION;
+CREATE DATABASE IF NOT EXISTS test;
+
use test;
-DROP TABLE users;
-DROP TABLE address;
-DROP TABLE TEXT_STORE;
+DROP TABLE IF EXISTS users;
+DROP TABLE IF EXISTS address;
+DROP TABLE IF EXISTS TEXT_STORE;
CREATE TABLE users (
id int,
@@ -229,4 +231,4 @@ INSERT INTO address (id, address_1, address_2, address_3) VALUES (96, '608-1826
INSERT INTO address (id, address_1, address_2, address_3) VALUES (97, 'P.O. Box 169, 2049 Eu Avenue', 'Duncan', 'Burundi');
INSERT INTO address (id, address_1, address_2, address_3) VALUES (98, '833-9890 Curabitur Rd.', 'Bierce', 'Cocos (Keeling) Islands');
INSERT INTO address (id, address_1, address_2, address_3) VALUES (99, 'P.O. Box 135, 833 Id, St.', 'Beaumaris', 'Syria');
-INSERT INTO address (id, address_1, address_2, address_3) VALUES (100, '881-6186 Pharetra. Ave', 'La Baie', 'United Arab Emirates');
\ No newline at end of file
+INSERT INTO address (id, address_1, address_2, address_3) VALUES (100, '881-6186 Pharetra. Ave', 'La Baie', 'United Arab Emirates');
diff --git a/src/main/webapp/customTag.jsp b/src/main/webapp/customTag.jsp
new file mode 100755
index 0000000..e785deb
--- /dev/null
+++ b/src/main/webapp/customTag.jsp
@@ -0,0 +1,14 @@
+<%@ taglib prefix = "ex" uri = "WEB-INF/custom.tld"%>
+
+
+
+ Custom Tag test
+
+
+
+ <%
+ String username = request.getParameter("name");
+ %>
+ Can you exploit it?
+
+
\ No newline at end of file
diff --git a/src/main/webapp/deserial.jsp b/src/main/webapp/deserial.jsp
index ded09c8..4c63d9e 100644
--- a/src/main/webapp/deserial.jsp
+++ b/src/main/webapp/deserial.jsp
@@ -14,7 +14,7 @@
<%
if (request.getMethod().equals("POST")) {
- out.println("Performing the deserialization of the HTTP request input stream.
");
+ out.println("Performing Java deserialization of the HTTP request input stream.
");
// get the request's input stream
ServletInputStream untrusted = request.getInputStream();
@@ -34,5 +34,58 @@
+
+
+
+
+
Test XML deserialization vulnerability
+
+
+
+ <%
+ String attack = (String) request.getAttribute("attack");
+ String name = (String) request.getAttribute("name");
+
+ if (name == null) {
+ name = "";
+ }
+
+ Integer age = (Integer) request.getAttribute("age");
+
+ if (age == null) {
+ age = 0;
+ }
+
+ if (attack != null) {
+ if ("xss".equals(attack)) {
+ out.println("
Deserialized User
");
+ out.println("Name: " + name + "
");
+ out.println("Age: " + age + "
");
+ out.println("
");
+ }
+ request.setAttribute("attack", null);
+ }
+ %>
+
+
+
+
+
+
<%@ include file="footer.jsp" %>
diff --git a/src/main/webapp/file.jsp b/src/main/webapp/file.jsp
index 670c542..afce422 100644
--- a/src/main/webapp/file.jsp
+++ b/src/main/webapp/file.jsp
@@ -1,8 +1,8 @@
<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
-
-
-
+
+
+
File
@@ -17,11 +17,18 @@
File
File URL
@@ -40,12 +47,18 @@
-
File Exec
+
File Exec
@@ -56,7 +69,19 @@
style="width: 100%; height: 20em"><%=textData%>
+
+
File from Cookie
+
+
+