36 lines
1.6 KiB
Bash
Executable File
36 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Regenerate every file under docs/output/. Nothing in the article or the chapters was typed by
|
|
# hand; it all came from here.
|
|
set -eu
|
|
cd "$(dirname "$0")/.."
|
|
mvn -B -q compile
|
|
[ -f target/cp.txt ] || mvn -B -q dependency:build-classpath -Dmdep.outputFile=target/cp.txt -Dmdep.includeScope=runtime
|
|
CP="target/classes:$(cat target/cp.txt)"
|
|
|
|
java -cp "$CP" com.ankurm.ssrf.FilterMatrix > docs/output/filter-matrix.txt
|
|
java -cp "$CP" com.ankurm.ssrf.AndVarargsTrap > docs/output/and-varargs-trap.txt
|
|
|
|
{
|
|
for p in "" docsfilter blocklist negated allowlist; do
|
|
echo "==================================================================================="
|
|
echo "PROFILE: ${p:-(none) - no InetAddressFilter bean}"
|
|
echo "==================================================================================="
|
|
./scripts/run.sh "$p" >/dev/null 2>&1 || { echo "FAILED TO START"; continue; }
|
|
./scripts/exploit.sh
|
|
echo
|
|
done
|
|
./scripts/stop.sh
|
|
} > docs/output/exploit-by-profile.txt 2>&1
|
|
|
|
# Two beans of the same type: the context does not start, and the diagnostic blames the wrong
|
|
# thing. Captured deliberately.
|
|
{
|
|
echo "\$ java -cp ... SsrfDemoApplication --spring.profiles.active=twofilters"
|
|
timeout 90 java -Xmx256m -cp "$CP" com.ankurm.ssrf.SsrfDemoApplication \
|
|
--spring.profiles.active=twofilters 2>&1 \
|
|
| grep -E 'expected single matching bean|APPLICATION FAILED|^Description|^Action|required a single bean|^\t- ' | head -20
|
|
} > docs/output/two-filter-beans.txt 2>&1
|
|
|
|
mvn -B test 2>&1 | grep -E 'Tests run:|WhereTheFilterRuns' > docs/output/tests.txt
|
|
echo "regenerated:"; ls -1 docs/output/
|