velocity | 易学教程

Apache Solr Velocity模板注入rce+获取交互式shell

阅读更多关于 Apache Solr Velocity模板注入rce+获取交互式shell

前言：官方的poc、exp payload只能获取很低的命令执行权限，甚至有些符号、命令还被过滤了，例如管道符被过滤。并且不能写入、下载文件，不能使用管道符重定向文件。那么我们只能通过获取到交互式shell来执行理想的命令。 0x01影响范围 Apache Solr 5.x - 8.2.0，存在config API版本 0x02环境搭建 vulhub上有几个apache solr的环境，我们使用vulhub上最新的环境“Apache Solr 远程命令执行漏洞（CVE-2019-0193）” 进入到vulhub目录下的solr漏洞的CVE-2019-0193下，然后执行命令： docker-compose up -d 一键开启环境，这个环境的solr是8.1.1，那么存在该漏洞。开启环境后，我们要先创建名为test的core，这才将漏洞环境完整搭好，命令为： docker-compose exec solr bash bin/solr create_core -c test -d example/example-DIH/solr/db dokcer ps看一下端口，然后进行http://ip:端口,访问默认8983端口 0x04漏洞利用我们要知道目标机的core名称才能进行下一步攻击，例如我们刚刚创建的core名称为test，我们看看 core admin

Apache's Velocity — getTemplate() . how to pass string/object instead of .VM file

阅读更多关于 Apache's Velocity — getTemplate() . how to pass string/object instead of .VM file

问题 Apache's Velocity — getTemplate(). Actually its allowing to pass the .vm file name , can i pass the string/object here? is there any method available to pass the string/object? 回答1: This is a sample code that is working for me. Velocity version: 1.7 I use log4j as a logger. import org.apache.log4j.Logger; import org.apache.velocity.Template; import org.apache.velocity.VelocityContext; import org.apache.velocity.app.Velocity; import org.apache.velocity.app.VelocityEngine; import org.apache

Can I add custom objects to Velocity context with Maven archetype plugin?

阅读更多关于 Can I add custom objects to Velocity context with Maven archetype plugin?

问题 We have a number of code generators that use Velocity to generate projects. The generation can be quite complicated: reflection is used (to introspect 3rd party proxies that we have to interface with) prior to calling velocity - the resulting properties (a complex object graph) are added to the velocity context the project structure and files can vary depending on the options selected the templates do more than just variable substitution (they make use of a custom object added to the velocity

change velocity logging to console

阅读更多关于 change velocity logging to console

问题 I'm trying to integrate velocity with an existing log4j.xml configuration and am hitting a wall. I can't seem to get it to use the console appender - no matter what I've tried it keeps sending out to velocity.log . <?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE log4j:configuration SYSTEM "log4j.dtd"> <log4j:configuration xmlns:log4j="http://jakarta.apache.org/log4j/"> <appender name="consoleAppender" class="org.apache.log4j.ConsoleAppender"> <layout class="org.apache.log4j.PatternLayout">

Where does Velocity search for the template?

阅读更多关于 Where does Velocity search for the template?

问题 I need to use Velocity from Java-code in a web-application (I use it as mail-templates processor). So, I have a standard code: VelocityEngine ve = new VelocityEngine (); try { ve.init (); Template t = ve.getTemplate (templatePath); ... } catch (Exception e) { throw new MailingException (e); } This code always throws the ResourceNotFoundException . Where should I place my templates in web-application (WEB-INF? classpath? etc?) and how should I specify path (i.e. what should I pass as

Tiny模板语言(VelocityPlus)初步入门

阅读更多关于 Tiny模板语言(VelocityPlus)初步入门

1 关于用户手册本文主要介绍如何在模板中使用Tiny模板语言，通过查阅本手册，可以对Tiny模板语言 TTL(Tiny Template Language)的用法有一个较全面的认识，并学会如何有效地使用Tiny模板语言。同时，本文提供了较多的例子帮您来学习并掌握它。 2 Tiny模板语言概述 Tiny 模板语言是一个参考 Velocity 语法的模板语言，它对 Velocity 模板语言中一些功能不太完全及使用过程中比较不方便的地方进行全面的扩展和升级，同时为了更好的适应Web界面层的开发，还提供了强大的布局功能。本文中的例子都使用Tiny 模板语言来开发。 <HTML> <BODY> Hello ${customer.Name}! <table> #for( mud : mudsOnSpecial ) #if ( customer.hasPurchased(mud) ) <tr> <td> ${flogger.getPromo( mud )} </td> </tr> #end #end </table> </BODY> </HTML> 感谢您选择Tiny模板引擎！ 3 Tiny模板语言能为您做什么？假设您是一家专门出售Mud的在线商店的页面设计人员，让我们暂且称它为“在线MUD商店”。您的业务非常繁忙，客户下了各种类型和数量的Mud订单

如何让程序员更容易的开发Web界面？重构SmartAdmin展示TinyUI框架

阅读更多关于如何让程序员更容易的开发Web界面？重构SmartAdmin展示TinyUI框架

序言如何让程序员更容易的开发Web界面，是一个持久的话题，所有的从事相关开发的公司都会碰到这个问题，并且被这个问题所深深困扰。 Tiny框架也不得不直视这个问题，确实来说，想解决这个问题，也是非常有难度与深度的，业界也有各种各样的尝试，这也是有各种各样不同框架出现的原因。 Tiny框架构建者认为，完全采用一种框架解决所有问题，是不现实的。而且即使目前找得到一种非常好的框架，暂时可以满足应用需要，但是随着技术的发展，业务的进化，就会慢慢变得不再满足业务需要。因此，Tiny框架构建从不再把做一套UI组件去适各种需求作为自己的目标。反过来，我们看看在做Web应用中，可能会碰到的问题： UI中JS的引入与顺序，JS合并的问题 UI中css的引入与顺序，CSS合并的问题 UI中碰到性能问题时的影响范围，比如：一个树出现问题，要改动许多用到树的地方代码重复的问题，同样的内容在许多地方都有，如果要改动就要改动许多个地方整体布局调整困难的问题程序员需要关注的内容太多的问题，JS,CSS,布局，后台业务，前台展现，尼玛界面工程师必须得是全才才可以搞得定所有问题。开发效率的问题执行效率的问题，前台响应要求速度更快集群的问题国际化的问题 ... 因此，我在以前写过一篇文章： UI开发的终极解决方案感兴趣的同学，可以去看看，今天的目标是利用TinyUI框架的重构SmartAdmin

Velocity - Passing current forloop variable to another template

阅读更多关于 Velocity - Passing current forloop variable to another template

问题 I have a Velocity template where I am using a for loop and within it, executing a parse statement. The problem is the parse statement needs access to the current object in the for loop but it seems to go out of scope. Having searched on here, I tried one suggestion to create a variable and assign the current variable in the iteration to it, but it only works for the first iteration. All subsequent iterations contain a reference to the first object in the iteration. An example: #foreach (

org.apache.velocity.exception.ResourceNotFoundException

阅读更多关于 org.apache.velocity.exception.ResourceNotFoundException

问题 I am using velocity engine template for mailing in struts1 and hibernate configuration. I got error: org.apache.velocity.exception.ResourceNotFoundException while I try to send mail. I have included velocity1.5.jar, mail.jar, activation.jar, smtp.jar. I include the velocity template path here String velocityTemplate = "mailTemplate/sendMail.vm"; and the mailTemplate folder is in WEB-INF/classes folder I got that error when code executes this line Template template = velocityEngine.getTemplate

How to access/get the size of an array/collection in velocity templates?

阅读更多关于 How to access/get the size of an array/collection in velocity templates?

问题 I am using velocity for email templates in my java/spring 3 app. How could I get the size of an ArrayList added to the model from within the template. 回答1: I've never used Velocity, but its VTL reference guide says that calling a method is done using $customer.getAddress() or ${purchase.getTotal()} . So I would use ${myArrayList.size()} . 回答2: A collection can be accessed like any other object, so $collection.size() will contain a value. Arrays are special cased to behave like List , so

订阅 velocity