hub / github.com/baidu-security/openrasp-testcases

github.com/baidu-security/openrasp-testcases @v1.1.21

Chat with this repo

repository ↗ · DeepWiki ↗ · release v1.1.21 ↗ · + Follow

1,121 symbols 4,167 edges 127 files 34 documented · 3%

What it actually does AI analysis from the code graph — generated when you open this

loading…

README

说明

OpenRASP 漏洞测试环境

Struts 系列漏洞
S2-001
S2-007
S2-008
S2-012
S2-013
S2-015
S2-016
S2-029
S2-032
Fastjson 反序列化漏洞
Jackson databind 反序列化漏洞
SQL 注入漏洞
MySQL
Oracle
PostgreSQL
SQLite
MSSQL
其他常见漏洞/后门
001 - 文件目录遍历
002 - 任意文件下载
004 - 命令执行后门
005 - 文件上传后门，小马传大马的场景
006 - 日志文件包含敏感信息，e.g 身份证、银行卡、CVV
007 - XXE 漏洞
008 - 基于 common io 上传文件
009 - Transformer 反序列化
010 - jstl import 任意文件包含
011 - SSRF 漏洞
012 - JDBC MySQL 注入测试，表单形式
微信 XXE 漏洞

PHP

常见漏洞
001 - 文件目录列出
002 - 任意文件下载
004 - 命令执行漏洞，有回显/无回显
005 - 任意文件写入 - file_put_contents 方式
008 - 基于 move_upload_file 上传文件
010 - include 方式任意文件包含
011 - SSRF 漏洞 - cURL 方式
012 - SQL注入 - mysqli 方式
013 - WebShell - 回调类型后门
014 - WebShell - 中国菜刀
015 - WebShell - 小马上传后门
016 - WebShell - 文件包含方式

Extension points exported contracts — how you extend this code

SQLInterface (Interface)

Created by lxk on 7/16/17. [4 implementers]

java/sqlcase/src/main/java/com/baidu/rasp/SQLInterface.java

IUserService (Interface)

Created by anyang on 2018/6/25. [2 implementers]

java/dubbo-demo/dubbo-interface/src/main/java/com/dubbo/demo_interface/api/IUserService.java

IHello (Interface)

(no doc) [2 implementers]

java/vulns-servlet/src/main/java/com/baidu/rasp/service/IHello.java

MyService (Interface)

(no doc) [2 implementers]

java/rmi-server/src/main/java/com/testnet/MyService.java

MyService (Interface)

(no doc) [1 implementers]

java/springboot-vulns/src/main/java/com/testnet/MyService.java

Core symbols most depended-on inside this repo

call

called by 174

java/vulns-servlet/src/main/java/com/baidu/rasp/task/DNSTask.java

parse

called by 13

java/springboot-vulns/src/main/java/com/example/controller/GroovyController.java

find

called by 9

java/dubbo-demo/dubbo-consumer/src/main/java/com/dubbo/consumer/UserController.java

getName

called by 5

java/freemarker/src/main/java/com/baidu/openrasp/Car.java

run

called by 5

java/springboot-vulns/src/main/java/com/example/controller/FreeMarkerController.java

select

called by 5

java/dubbo-demo/dubbo-interface/src/main/java/com/dubbo/demo_interface/api/IUserService.java

path

called by 3

java/springboot-vulns/src/main/java/com/example/controller/ThymeleafController.java

getHostNames

called by 3

java/vulns-servlet/src/main/java/com/baidu/rasp/task/DNSTask.java

Shape

Function 845

Method 183

Class 88

Interface 5

Languages

TypeScript74%

Java25%

Python1%

PHP1%

Modules by API surface

php/vulns/assets/js/angular.min.js278 symbols

java/vulns/src/main/webapp/assets/js/angular.min.js278 symbols

java/vulns-servlet/src/webapp/js/angular.min.js278 symbols

java/vulns-servlet/src/main/java/com/baidu/rasp/Xxe_sax.java9 symbols

java/freemarker/src/main/java/com/baidu/openrasp/Car.java6 symbols

java/fastjson/src/main/java/person/Person.java6 symbols

java/fastjson-1.2.60/src/main/java/person/Person.java6 symbols

java/vulns-servlet/src/main/java/com/baidu/rasp/MysqlPrepared.java5 symbols

java/vulns-servlet/src/main/java/com/baidu/rasp/Mysql.java5 symbols

java/sqlcase/src/main/java/com/baidu/rasp/BaseSqlServlet.java5 symbols

java/springboot-vulns/src/main/java/com/example/controller/FreeMarkerController.java5 symbols

java/rmi-server/src/main/java/com/testnet/MyServiceImpl.java5 symbols

Datastores touched

(mysql)Database · 1 repos

test1Database · 1 repos

testdbDatabase · 1 repos

For agents

$ claude mcp add openrasp-testcases \
  -- python -m otcore.mcp_server <graph>

⬇ download graph artifact

github.com/baidu-security/openrasp-testcases @v1.1.21

说明

目录

Java 应用服务器

PHP

Extension points exported contracts — how you extend this code

Core symbols most depended-on inside this repo

Shape

Languages

Modules by API surface

Datastores touched

For agents

Ask about this repo answers extend the page