[::ACSC Quals 2021::] — Breaking Logics

  1. I try Tomcat 8 + Java 8 for local but it cant be up because Wro compatible Java 9
  2. then I try Tomcat 7 + Java 9, but this time the payload didn’t work as usual because the different logic between servletContext.getRealPath() of Tomcat 7 and Tomcat 8
  3. Finally I try Tomcat 8 + Java 9 and it matchs the remote environment, this make me watse a lot of time for setting environment :(

Enviroment setup

unzip the WAR and import it to IDEA
Notice the Java bytecode version
Tomcat 8 and Java 9
ROOT context of tomcat
config remote debug on IDEA

Analysis

web.xml
WroFilter.doFilter()

Conclusion

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store