µÚ1Õ ´úÂëÉó¼Æ»ù´¡

1.1JavaWebÇéÐδ

1.1.1JavaEEÏÈÈÝ
1.1.2JavaEEÇéÐδ

1.2JavaWeb¶¯Ì¬µ÷ÊÔ

1.2.1Eclipse¶¯Ì¬µ÷ÊÔ
1.2.2IDEA¶¯Ì¬µ÷ÊÔ³ÌÐò

µÚ2Õ³£¼ûÎó²îÉó¼Æ

2.1SQL×¢ÈëÎó²î

2.1.1SQL×¢ÈëÎó²î¼ò½é
2.1.2Ö´ÐÐSQLÓï¾äµÄ¼¸ÖÖ·½·¨
2.1.3³£¼ûJavaSQL×¢Èë
2.1.4ͨÀý×¢Èë´úÂëÉó¼Æ
2.1.5¶þ´Î×¢Èë´úÂëÉó¼Æ
2.1.6SQL×¢ÈëÎó²îÐÞ¸´

2.2í§ÒâÎļþÉÏ´«Îó²î

2.2.1³£¼ûÎļþÉÏ´«·½·¨
2.2.2ÎļþÉÏ´«Îó²îÉó¼Æ
2.2.3ÎļþÉÏ´«Îó²îÐÞ¸´

2.3XSSÎó²î

2.3.1XSS³£¼û´¥·¢Î»ÖÃ
2.3.2·´ÉäÐÍXSS
2.3.3´æ´¢ÐÍXSS
2.3.4XSSÎó²îÐÞ¸´

2.4Ŀ¼´©Ô½Îó²î

2.4.1Ŀ¼´©Ô½Îó²î¼ò½é
2.4.2Ŀ¼´©Ô½Îó²îÉó¼Æ
2.4.3Ŀ¼´©Ô½Îó²îÐÞ¸´

2.5URLÌøתÎó²î

2.5.1URLÖض¨Ïò
2.5.2URLÌøתÎó²îÉó¼Æ
2.5.3URLÌøתÎó²îÐÞ¸´

2.6ÏÂÁîÖ´ÐÐÎó²î

2.6.1ÏÂÁîÖ´ÐÐÎó²î¼ò½é
2.6.2ProcessBuilderÏÂÁîÖ´ÐÐÎó²î
2.6.3RuntimeexecÏÂÁîÖ´ÐÐÎó²î
2.6.4ÏÂÁîÖ´ÐÐÎó²îÐÞ¸´

2.7XXEÎó²î

2.7.1XMLµÄ³£¼û½Ó¿Ú
2.7.2XXEÎó²îÉó¼Æ
2.7.3XXEÎó²îÐÞ¸´

2.8SSRFÎó²î

2.8.1SSRFÎó²î¼ò½é
2.8.2SSRFÎó²î³£¼û½Ó¿Ú
2.8.3SSRFÎó²îÉó¼Æ
2.8.4SSRFÎó²îÐÞ¸´

2.9SpEL±í´ïʽעÈëÎó²î

2.9.1SpELÏÈÈÝ
2.9.2SpELÎó²î
2.9.3SpELÎó²îÉó¼Æ
2.9.4SpELÎó²îÐÞ¸´

2.10Java·´ÐòÁл¯Îó²î

2.10.1JavaÐòÁл¯Óë·´ÐòÁл¯
2.10.2Java·´ÐòÁл¯Îó²îÉó¼Æ
2.10.3Java·´ÐòÁл¯Îó²îÐÞ¸´

2.11SSTIÄ£°å×¢ÈëÎó²î

2.11.1VelocityÄ£°åÒýÇæÏÈÈÝ
2.11.2SSTIÎó²îÉó¼Æ
2.11.3SSTIÎó²îÐÞ¸´

2.12ÕûÊýÒç³öÎó²î

2.12.1ÕûÊýÒç³öÎó²îÏÈÈÝ
2.12.2ÕûÊýÒç³öÎó²îÐÞ¸´

2.13Ó²±àÂëÃÜÂëÎó²î
2.14²»Çå¾²µÄËæ»úÊýÌìÉúÆ÷

µÚ3Õ³£¼ûµÄ¿ò¼ÜÎó²î

3.1Spring¿ò¼Ü

3.1.1SpringÏÈÈÝ
3.1.2µÚÒ»¸öSpringMVCÏîÄ¿
3.1.3CVE-2018-1260SpringSecurityOAuth2RCE
3.1.4CVE-2018-1273SpringDataCommonsRCE
3.1.5CVE-2017-8046SpringDataRestRCE

3.2Struts2¿ò¼Ü

3.2.1Struts2ÏÈÈÝ
3.2.2µÚÒ»¸öStruts2ÏîÄ¿
3.2.3OGNL±í´ïʽÏÈÈÝ
3.2.4S2-045Ô¶³Ì´úÂëÖ´ÐÐÎó²î
3.2.5S2-048Ô¶³Ì´úÂëÖ´ÐÐÎó²î
3.2.6S2-057Ô¶³Ì´úÂëÖ´ÐÐÎó²î

µÚ4Õ´úÂëÉó¼Æʵս

4.1OFCMSÉó¼Æ°¸Àý

4.1.1SQL×¢ÈëÎó²î
4.1.2Ŀ¼±éÀúÎó²î
4.1.3í§ÒâÎļþÉÏ´«Îó²î
4.1.4Ä£°å×¢ÈëÎó²î
4.1.5Öü´æÐÍXSSÎó²î
4.1.6CSRFÎó²î

4.2MCMSÉó¼Æ°¸Àý

4.2.1í§ÒâÎļþÉÏ´«Îó²î
4.2.2í§ÒâÎļþ½âѹ