weblogic

I have developed this proof of concept https://github.com/DISID/disid-proofs/tree/master/spring-boot-weblogic to test the deployment of Spring Boot applications in Weblogic 12c (12.2.1). The application deploys and starts successfully, but when I try to connect to it (i.e. /accounts?number=1234 ) the error below is shown: Error 500--Internal Server Error From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1: 10.5.1 500 Internal Server Error The server encountered an unexpected condition which prevented it from fulfilling the request. And the log file has the exception: org.springframework

I'm launching a Weblogic application inside Eclipse via the BEA Weblogic Server v9.2 runtime environment. If this were running straight from the command-line, I'd do a ctrl-BREAK to force a thread dump. Is there a way to do it in Eclipse? Indeed (thanks VonC to point to the SO thread), Dustin, in a comment to his message, points to jstack . I have run a little Java application (with GUI) in Eclipse, I can see the related javaw.exe in Windows' process manager and its PID, 7088 (it is even simpler in Unix, of course). If I type at a command prompt jstack 7088 , I have the wanted stack dump per

前言 什么是ssrf SSRF(Server-Side Request Forgery:服务器端请求伪造) 是一种由攻击者构造形成由服务端发起请求的一个安全漏洞。 一般情况下，SSRF攻击的目标是从外网无法访问的内部系统。 举一个例子： 比如一个添加图文的功能，填入标题内容和封面图然后提交在网站前台显示，对于这个功能的图片它除了可以让你上传以外，还支持填入远程图片地址，如果你填入了远程的图片地址，则该网站会加载远程图过来进行显示，而如果程序写法不严谨或者过滤不严格，则加载图片地址的这个功能可能就可以包含进行一些恶意的脚本文件，或者你输入内网的 ip 或者一些系统的文件都会被解析执行，这个我们一般叫它 SSRF 即服务端请求伪造。 危害：一般我们是无法请求到系统上的文件的，内网的 ip 我们也是无法访问的，有了 SSRF 后，我们提交的加载连接是用服务器进行加载解析，实际上相当于我们以存在 SSRF 这个服务器为跳板进行的一些加载操作。 一般ssrf漏洞的页面是get请求，访问内网地址的时候返回的是状态码，根据返回信息，我们可以对内网的IP和端口进行信息收集，可以收集到一些内网机子的断开开放情况 比如redis服务，如果内网有IP开启6379端口，那么我们就可以用存在ssrf的机子给含有redis服务的机子发送命令，然后反弹shell.

Weblogic 10.3.1.0 is using com.bea.core.apache.commons.net_1.0.0.0_1-4-1.jar... I want to use commons-net-2.0.jar from my code. How can I force it to use the newer JAR in my code only? I want to use commons-net-2.0.jar from my code. WebLogic uses a parent class loader first strategy and you basically have two options to tweak this behavior: Use the prefer-web-inf-classes element in a weblogic.xml Web application deployment descriptor (that goes in WEB-INF next to the web.xml ) ~or~ Package your war insider an EAR and use WebLogic Filtering classloader that you configure in a weblogic