You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I ran the program for the following pattern: \$\{(?<name>.*?)(:(?<default>.*?))?\}.
I received the following output, which I truncate for the sake of better visibility:
If I remember correctly, two ways I recommended. One is run the jar with parameter "-v" (you can get all available parameters by "-h"), then put the regex and the attack string through UI widget, another is writing a simple java program by hand, call the Regex.match with the regex and the string to check.
As you know, this work is done based on JDK 8 I think, but these years, JDK upgraded many times, I can't promise the attack string is still work for the new JDK, maybe u could implement the strategy by yourself.
I ran the program for the following pattern:
\$\{(?<name>.*?)(:(?<default>.*?))?\}
.I received the following output, which I truncate for the sake of better visibility:
How am I supposed to interpret the result that a vulnerable string has been found, but the attack failed nevertheless?
The text was updated successfully, but these errors were encountered: