⽬标所⽤ Waf 种类识别 与 绕过 BypassWAF ⽂件上传 / 读取 / 下载 BypassWAF Sql注⼊ BypassWAF RCE BypassWAF 各类Java Web中间件已知Nday漏洞利⽤ BypassWAF Webshell 免杀 其它更多 待补充修 其它更多 , 待补充修正... 0x02 ⼊⼝权限获取 [外部防御重⼼ 故,仅仅只挑选了⼀些相对会经常遇到的,且实战中确实能有效协助快速getshell 的 "中间件" , "开源程序" 及 "web组件" 针对各类 Java 中间件的各种已知 Nday 漏洞利⽤ 不同于其它脚本类web程序,Java的运⾏权限通常都⽐较⾼,甚⾄⼤部分都是直接⽤root/administrator/system 权限在跑 所以拿到的shell权限⼀般也⾮常⾼,通常都直接是服务器权限 未授权访问,敏感信息泄露 RabbitMQ 弱⼝令 Glassfish 任意⽂件读取 [ 低版本 ] 控制台弱⼝令,部署webshell IBM Websphere Java 反序列化 控制台弱⼝令,部署webshell Axis2 任意⽂件读取 ⽬录遍历 Apache ActiveMQ 未授权访问,5.12 之前的版本 fileserver存在

mentor telling you what not to worry about  Perf events mixed mode can show stack traces of both Java and native system calls Continuous Delivery in Financial Training by David Genn (IG) @david_genn

that could become an error and will likely trigger an alert 4. Error – error conditions such as API failures, internal issues 5. Fatal – forces a termination iv. Examples of potentially significant Use telemetry to measure outcomes iv. Etsy open-sourced their experimentation framework – Feature API e. INTEGRATE A/B TESTING INTO OUR FEATURE PLANNING i. Product owners should consider each feature

suite becomes the living documentation of the system specification and represent working examples of API use e. DESIGN FOR OPERATIONS THROUGH CODIFIED NON-FUNCTIONAL REQUIREMENTS i. Designing for fast changes through pair programming or code review 3. Instrument the repository to detect suspicious code (API calls from certain types of test code) 4. Ensure every CI process is in an isolated container 5

Coined by Martin Fowler in 2004 ii. Strangler Application 1. Put existing functionality behind an API 2. New functionality implemented in new services with new architecture 3. Make calls to old system