{"id":478257,"date":"2023-08-09T09:29:53","date_gmt":"2023-08-09T09:29:53","guid":{"rendered":""},"modified":"2023-09-05T11:16:22","modified_gmt":"2023-09-05T11:16:22","slug":"ognl-injection","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/ir\/wiki\/ognl-injection\/","title":{"rendered":"\u062a\u0632\u0631\u06cc\u0642 OGNL"},"content":{"rendered":"<p>\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u062e\u062a\u0635\u0631\u06cc \u062f\u0631 \u0645\u0648\u0631\u062f \u062a\u0632\u0631\u06cc\u0642 OGNL<\/p>\n<p>\u062a\u0632\u0631\u06cc\u0642 OGNL (Object-Graph Navigation Language) \u0646\u0648\u0639\u06cc \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc \u062f\u0647\u062f \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0627 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647 \u0648\u0628 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0634\u06a9\u0644 \u0627\u0632 \u062d\u0645\u0644\u0647 \u0634\u0627\u0645\u0644 \u0628\u0647\u0631\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0639\u0628\u0627\u0631\u0627\u062a OGNL \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u062f\u0631 \u0686\u0627\u0631\u0686\u0648\u0628 \u0647\u0627\u06cc \u0648\u0628 \u062e\u0627\u0635\u060c \u0628\u0647 \u0648\u06cc\u0698\u0647 Apache Struts \u0627\u0633\u062a. \u062a\u0632\u0631\u06cc\u0642 OGNL \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0645\u0646\u062c\u0631 \u0628\u0647 \u0627\u0641\u0634\u0627\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u063a\u06cc\u0631\u0645\u062c\u0627\u0632\u060c \u0627\u0635\u0644\u0627\u062d \u062f\u0627\u062f\u0647\u200c\u0647\u0627 \u06cc\u0627 \u062d\u062a\u06cc \u0628\u0647 \u062e\u0637\u0631 \u0627\u0641\u062a\u0627\u062f\u0646 \u06a9\u0627\u0645\u0644 \u0633\u06cc\u0633\u062a\u0645 \u0634\u0648\u062f.<\/p>\n<h2>\u062a\u0627\u0631\u06cc\u062e\u0686\u0647 \u067e\u06cc\u062f\u0627\u06cc\u0634 \u062a\u0632\u0631\u06cc\u0642 OGNL \u0648 \u0627\u0648\u0644\u06cc\u0646 \u0630\u06a9\u0631 \u0622\u0646<\/h2>\n<p>\u062a\u0632\u0631\u06cc\u0642 OGNL \u062f\u0631 \u06a9\u0646\u0627\u0631 \u0631\u0634\u062f \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc \u0648\u0628 \u0648 \u0686\u0627\u0631\u0686\u0648\u0628\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0631\u0627\u06cc \u0627\u0647\u062f\u0627\u0641 \u0645\u062e\u062a\u0644\u0641\u06cc \u0627\u0632 \u062c\u0645\u0644\u0647 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u062f\u0627\u062f\u0647\u200c\u0647\u0627 \u0648 \u0631\u0646\u062f\u0631 \u0631\u0627\u0628\u0637 \u06a9\u0627\u0631\u0628\u0631\u06cc \u0628\u0631 \u0639\u0628\u0627\u0631\u0627\u062a OGNL \u0645\u062a\u06a9\u06cc \u0628\u0648\u062f\u0646\u062f\u060c \u0634\u0646\u0627\u062e\u062a\u0647 \u0634\u062f. Apache Struts\u060c \u06cc\u06a9 \u0686\u0627\u0631\u0686\u0648\u0628 \u0645\u0646\u0628\u0639 \u0628\u0627\u0632 \u0645\u062d\u0628\u0648\u0628 \u0628\u0631\u0627\u06cc \u062a\u0648\u0633\u0639\u0647 \u0628\u0631\u0646\u0627\u0645\u0647 \u0647\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc \u0648\u0628 \u062c\u0627\u0648\u0627\u060c \u0642\u0631\u0628\u0627\u0646\u06cc \u0627\u0635\u0644\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0634\u062f.<\/p>\n<p>\u0627\u0648\u0644\u06cc\u0646 \u0630\u06a9\u0631 \u0639\u0645\u0648\u0645\u06cc \u0627\u0632 \u062a\u0632\u0631\u06cc\u0642 OGNL \u062f\u0631 \u0633\u0627\u0644 2011 \u0628\u0648\u062f \u06a9\u0647 \u06cc\u06a9 \u0645\u062d\u0642\u0642 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u062f\u0631 Apache Struts2 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f. \u0627\u06cc\u0646 \u0627\u0641\u0634\u0627\u06af\u0631\u06cc \u0633\u0631\u0622\u063a\u0627\u0632 \u06cc\u06a9 \u0633\u0631\u06cc \u062a\u062d\u0642\u06cc\u0642\u0627\u062a \u0648 \u0627\u06a9\u062a\u0634\u0627\u0641\u0627\u062a \u0628\u06cc\u0634\u062a\u0631 \u062f\u0631 \u0645\u0648\u0631\u062f \u062e\u0637\u0631\u0627\u062a \u0648 \u0628\u0631\u062f\u0627\u0631\u0647\u0627\u06cc \u062d\u0645\u0644\u0647 \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 OGNL \u0628\u0648\u062f.<\/p>\n<h2>\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062f\u0642\u06cc\u0642 \u062f\u0631 \u0645\u0648\u0631\u062f \u062a\u0632\u0631\u06cc\u0642 OGNL: \u06af\u0633\u062a\u0631\u0634 \u0645\u0648\u0636\u0648\u0639 \u062a\u0632\u0631\u06cc\u0642 OGNL<\/h2>\n<p>\u062a\u0632\u0631\u06cc\u0642 OGNL \u0641\u0642\u0637 \u0628\u0647 Apache Struts \u0645\u062d\u062f\u0648\u062f \u0646\u0645\u06cc \u0634\u0648\u062f\u060c \u0628\u0644\u06a9\u0647 \u0645\u06cc \u062a\u0648\u0627\u0646\u062f \u0628\u0631 \u0641\u0631\u06cc\u0645\u0648\u0631\u06a9 \u0647\u0627\u06cc \u062f\u06cc\u06af\u0631\u06cc \u06a9\u0647 \u0627\u0632 OGNL \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u0646\u062f \u0646\u06cc\u0632 \u062a\u0623\u062b\u06cc\u0631 \u0628\u06af\u0630\u0627\u0631\u062f. \u0627\u06cc\u0646 \u0632\u0628\u0627\u0646 \u0628\u06cc\u0627\u0646 \u0642\u062f\u0631\u062a\u0645\u0646\u062f \u0628\u0631\u0627\u06cc \u062f\u0631\u06cc\u0627\u0641\u062a \u0648 \u062a\u0646\u0638\u06cc\u0645 \u0648\u06cc\u0698\u06af\u06cc \u0647\u0627\u06cc \u0627\u0634\u06cc\u0627\u0621 \u062c\u0627\u0648\u0627 \u0637\u0631\u0627\u062d\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a. \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u06cc \u062a\u0648\u0627\u0646\u0646\u062f \u0639\u0628\u0627\u0631\u0627\u062a \u0645\u062e\u0631\u0628 OGNL \u0631\u0627 \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u0646\u062f \u06a9\u0647 \u0648\u0642\u062a\u06cc \u062a\u0648\u0633\u0637 \u0633\u0631\u0648\u0631 \u0627\u0631\u0632\u06cc\u0627\u0628\u06cc \u0645\u06cc \u0634\u0648\u062f\u060c \u06a9\u062f \u062c\u0627\u0648\u0627 \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0627 \u0627\u062c\u0631\u0627 \u0645\u06cc \u06a9\u0646\u062f.<\/p>\n<h3>\u0634\u062f\u062a<\/h3>\n<p>\u062a\u0632\u0631\u06cc\u0642 OGNL \u0645\u06cc \u062a\u0648\u0627\u0646\u062f \u0645\u0646\u062c\u0631 \u0628\u0647 \u0622\u0633\u06cc\u0628 \u0634\u062f\u06cc\u062f \u0628\u0647 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647 \u06cc\u0627 \u06cc\u06a9 \u0633\u06cc\u0633\u062a\u0645 \u0634\u0648\u062f. \u0645\u06cc \u062a\u0648\u0627\u0646\u062f \u0645\u0646\u062c\u0631 \u0628\u0647:<\/p>\n<ul>\n<li>\u062f\u0633\u062a\u0631\u0633\u06cc \u063a\u06cc\u0631\u0645\u062c\u0627\u0632<\/li>\n<li>\u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u062f\u0627\u062f\u0647<\/li>\n<li>\u062a\u0635\u0627\u062d\u0628 \u0633\u06cc\u0633\u062a\u0645<\/li>\n<\/ul>\n<h3>\u0628\u0631\u062f\u0627\u0631\u0647\u0627\u06cc \u062d\u0645\u0644\u0647<\/h3>\n<p>\u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0632 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0646\u0627\u0627\u0645\u0646 \u0648\u0631\u0648\u062f\u06cc \u06a9\u0627\u0631\u0628\u0631 \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u0646\u062f \u0648 \u0639\u0628\u0627\u0631\u0627\u062a OGNL \u0631\u0627 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u0645\u06cc \u06a9\u0646\u0646\u062f. \u0628\u0631\u062f\u0627\u0631\u0647\u0627\u06cc \u062d\u0645\u0644\u0647 \u0645\u0639\u0645\u0648\u0644\u06cc \u0639\u0628\u0627\u0631\u062a\u0646\u062f \u0627\u0632:<\/p>\n<ul>\n<li>\u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0647\u0627\u06cc HTTP<\/li>\n<li>\u0633\u0627\u062e\u062a URL \u0647\u0627\u06cc \u0645\u062e\u0631\u0628<\/li>\n<li>\u062a\u063a\u06cc\u06cc\u0631 \u067e\u0627\u0631\u0627\u0645\u062a\u0631\u0647\u0627\u06cc \u0641\u0631\u0645<\/li>\n<\/ul>\n<h2>\u0633\u0627\u062e\u062a\u0627\u0631 \u062f\u0627\u062e\u0644\u06cc \u062a\u0632\u0631\u06cc\u0642 OGNL: \u0646\u062d\u0648\u0647 \u0639\u0645\u0644\u06a9\u0631\u062f \u062a\u0632\u0631\u06cc\u0642 OGNL<\/h2>\n<p>\u062a\u0632\u0631\u06cc\u0642 OGNL \u0632\u0645\u0627\u0646\u06cc \u0627\u062a\u0641\u0627\u0642 \u0645\u06cc\u200c\u0627\u0641\u062a\u062f \u06a9\u0647 \u06cc\u06a9 \u0645\u0647\u0627\u062c\u0645 \u0628\u062a\u0648\u0627\u0646\u062f \u0639\u0628\u0627\u0631\u0627\u062a \u0645\u062e\u0631\u0628 OGNL \u0631\u0627 \u0628\u0647 \u0648\u0631\u0648\u062f\u06cc \u0628\u0631\u0646\u0627\u0645\u0647 \u062a\u0632\u0631\u06cc\u0642 \u06a9\u0646\u062f. \u062f\u0631 \u0627\u06cc\u0646\u062c\u0627 \u0646\u062d\u0648\u0647 \u0639\u0645\u0644\u06a9\u0631\u062f \u062a\u0632\u0631\u06cc\u0642 OGNL \u0628\u0647 \u0635\u0648\u0631\u062a \u06af\u0627\u0645 \u0628\u0647 \u06af\u0627\u0645 \u0634\u0631\u062d \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a:<\/p>\n<ol>\n<li><strong>\u0645\u062f\u06cc\u0631\u06cc\u062a \u0648\u0631\u0648\u062f\u06cc \u06a9\u0627\u0631\u0628\u0631<\/strong>: \u0628\u0631\u0646\u0627\u0645\u0647 \u0628\u0647 \u0637\u0648\u0631 \u0646\u0627\u0645\u0646\u0627\u0633\u0628 \u0648\u0631\u0648\u062f\u06cc \u06a9\u0627\u0631\u0628\u0631 \u062d\u0627\u0648\u06cc \u0639\u0628\u0627\u0631\u062a OGNL \u0631\u0627 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0645\u06cc \u06a9\u0646\u062f.<\/li>\n<li><strong>\u062a\u062c\u0632\u06cc\u0647 \u0628\u06cc\u0627\u0646<\/strong>: \u0633\u0631\u0648\u0631 \u0639\u0628\u0627\u0631\u062a \u0645\u062e\u0631\u0628 \u0631\u0627 \u062a\u062c\u0632\u06cc\u0647 \u0645\u06cc \u06a9\u0646\u062f.<\/li>\n<li><strong>\u0627\u062c\u0631\u0627\u06cc \u06a9\u062f<\/strong>: \u0639\u0628\u0627\u0631\u062a \u0645\u0648\u0631\u062f \u0627\u0631\u0632\u06cc\u0627\u0628\u06cc \u0642\u0631\u0627\u0631 \u0645\u06cc \u06af\u06cc\u0631\u062f \u06a9\u0647 \u0645\u0646\u062c\u0631 \u0628\u0647 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u062f\u0631 \u0633\u0631\u0648\u0631 \u0645\u06cc \u0634\u0648\u062f.<\/li>\n<li><strong>\u0646\u062a\u06cc\u062c\u0647 \u062d\u0645\u0644\u0647<\/strong>: \u0645\u0647\u0627\u062c\u0645 \u06a9\u0646\u062a\u0631\u0644 \u06cc\u0627 \u062f\u0633\u062a\u0631\u0633\u06cc \u063a\u06cc\u0631\u0645\u062c\u0627\u0632 \u0628\u0647 \u062f\u0627\u062f\u0647 \u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u0631\u0627 \u0628\u0647 \u062f\u0633\u062a \u0645\u06cc \u0622\u0648\u0631\u062f.<\/li>\n<\/ol>\n<h2>\u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0648\u06cc\u0698\u06af\u06cc \u0647\u0627\u06cc \u06a9\u0644\u06cc\u062f\u06cc OGNL Injection<\/h2>\n<p>\u062a\u0632\u0631\u06cc\u0642 OGNL \u0628\u0647 \u062f\u0644\u06cc\u0644 \u0686\u0646\u062f\u06cc\u0646 \u0648\u06cc\u0698\u06af\u06cc \u0628\u0631\u062c\u0633\u062a\u0647 \u0627\u0633\u062a:<\/p>\n<ul>\n<li><strong>\u062a\u0637\u0628\u06cc\u0642 \u067e\u0630\u06cc\u0631\u06cc<\/strong>: \u0645\u06cc \u062a\u0648\u0627\u0646 \u0627\u0632 \u0622\u0646 \u0628\u0631\u0627\u06cc \u0627\u0647\u062f\u0627\u0641 \u0645\u062e\u0631\u0628 \u0645\u062e\u062a\u0644\u0641\u060c \u0627\u0632 \u0633\u0631\u0642\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u06af\u0631\u0641\u062a\u0647 \u062a\u0627 \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u0633\u06cc\u0633\u062a\u0645 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f.<\/li>\n<li><strong>\u067e\u06cc\u0686\u06cc\u062f\u06af\u06cc<\/strong>: \u0627\u06cc\u062c\u0627\u062f \u0639\u0628\u0627\u0631\u0627\u062a \u0645\u062e\u0631\u0628 OGNL \u0646\u06cc\u0627\u0632 \u0628\u0647 \u062f\u0627\u0646\u0634 \u0645\u062d\u06cc\u0637 \u062c\u0627\u0648\u0627 \u0648 \u0686\u0627\u0631\u0686\u0648\u0628 \u062e\u0627\u0635 \u062f\u0627\u0631\u062f.<\/li>\n<li><strong>\u062a\u0627\u062b\u06cc\u0631 \u0628\u0627\u0644\u0627<\/strong>: \u0622\u0633\u06cc\u0628 \u0627\u062d\u062a\u0645\u0627\u0644\u06cc \u06cc\u06a9 \u062d\u0645\u0644\u0647 \u0645\u0648\u0641\u0642\u06cc\u062a \u0622\u0645\u06cc\u0632 \u0642\u0627\u0628\u0644 \u062a\u0648\u062c\u0647 \u0627\u0633\u062a.<\/li>\n<li><strong>\u06a9\u0627\u0647\u0634 \u0622\u0646 \u062f\u0634\u0648\u0627\u0631 \u0627\u0633\u062a<\/strong>: \u0627\u06cc\u0645\u0646 \u0633\u0627\u0632\u06cc \u0645\u0646\u0627\u0633\u0628 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647 \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u062a\u0632\u0631\u06cc\u0642 OGNL \u0646\u06cc\u0627\u0632\u0645\u0646\u062f \u0627\u0639\u062a\u0628\u0627\u0631\u0633\u0646\u062c\u06cc \u0648\u0631\u0648\u062f\u06cc \u062f\u0642\u06cc\u0642 \u0648 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0645\u0646\u0627\u0633\u0628 \u0686\u0627\u0631\u0686\u0648\u0628 \u0627\u0633\u062a.<\/li>\n<\/ul>\n<h2>\u0627\u0646\u0648\u0627\u0639 \u062a\u0632\u0631\u06cc\u0642 OGNL: \u0627\u0632 \u062c\u062f\u0627\u0648\u0644 \u0648 \u0644\u06cc\u0633\u062a \u0647\u0627 \u0628\u0631\u0627\u06cc \u0646\u0648\u0634\u062a\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f<\/h2>\n<p>\u062f\u0631 \u0627\u0635\u0644 \u062f\u0648 \u0646\u0648\u0639 \u062a\u0632\u0631\u06cc\u0642 OGNL \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f:<\/p>\n<table>\n<thead>\n<tr>\n<th>\u062a\u0627\u06cc\u067e \u06a9\u0646\u06cc\u062f<\/th>\n<th>\u0634\u0631\u062d<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u062a\u0632\u0631\u06cc\u0642 \u06a9\u0644\u0627\u0633\u06cc\u06a9 OGNL<\/td>\n<td>\u0627\u0632 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0646\u0627\u0627\u0645\u0646 \u0648\u0631\u0648\u062f\u06cc \u0647\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631 \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u062f \u0648 \u0645\u0646\u062c\u0631 \u0628\u0647 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u0645\u06cc \u0634\u0648\u062f.<\/td>\n<\/tr>\n<tr>\n<td>\u062a\u0632\u0631\u06cc\u0642 OGNL \u06a9\u0648\u0631<\/td>\n<td>\u06cc\u06a9 \u0646\u0648\u0639 \u0645\u062e\u0641\u06cc \u062a\u0631 \u06a9\u0647 \u062f\u0631 \u0622\u0646 \u0645\u0647\u0627\u062c\u0645 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0631\u0627 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0631\u0648\u0634 \u0647\u0627\u06cc \u063a\u06cc\u0631\u0645\u0633\u062a\u0642\u06cc\u0645\u060c \u0645\u0627\u0646\u0646\u062f \u0645\u0634\u0627\u0647\u062f\u0647 \u0632\u0645\u0627\u0646 \u067e\u0627\u0633\u062e\u060c \u0627\u0633\u062a\u0646\u0628\u0627\u0637 \u0645\u06cc \u06a9\u0646\u062f.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u0631\u0627\u0647\u200c\u0647\u0627\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u062a\u0632\u0631\u06cc\u0642 OGNL\u060c \u0645\u0634\u06a9\u0644\u0627\u062a \u0648 \u0631\u0627\u0647\u200c\u062d\u0644\u200c\u0647\u0627\u06cc \u0622\u0646\u0647\u0627 \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647<\/h2>\n<h3>\u0631\u0627\u0647 \u0647\u0627\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647<\/h3>\n<ol>\n<li><strong>\u0627\u0641\u0634\u0627\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a<\/strong>: \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062d\u0633\u0627\u0633 \u0627\u0632 \u0633\u0631\u0648\u0631.<\/li>\n<li><strong>\u062f\u0633\u062a\u0631\u0633\u06cc \u063a\u06cc\u0631\u0645\u062c\u0627\u0632<\/strong>: \u062f\u0648\u0631 \u0632\u062f\u0646 \u0645\u06a9\u0627\u0646\u06cc\u0633\u0645 \u0647\u0627\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a.<\/li>\n<li><strong>\u0628\u0647 \u062e\u0637\u0631 \u0627\u0641\u062a\u0627\u062f\u0646 \u0633\u06cc\u0633\u062a\u0645<\/strong>: \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u06af\u0631\u0641\u062a\u0646 \u06a9\u0644 \u0633\u06cc\u0633\u062a\u0645.<\/li>\n<\/ol>\n<h3>\u0645\u0634\u06a9\u0644\u0627\u062a \u0648 \u0631\u0627\u0647 \u062d\u0644 \u0647\u0627<\/h3>\n<ul>\n<li><strong>\u0645\u0633\u0626\u0644\u0647<\/strong>: \u0645\u062f\u06cc\u0631\u06cc\u062a \u0646\u0627\u0627\u0645\u0646 \u0648\u0631\u0648\u062f\u06cc \u0647\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\n<ul>\n<li><strong>\u0631\u0627\u0647 \u062d\u0644<\/strong>: \u0627\u0639\u062a\u0628\u0627\u0631 \u0633\u0646\u062c\u06cc \u0648\u0631\u0648\u062f\u06cc \u0648 \u067e\u0627\u06a9\u0633\u0627\u0632\u06cc \u062f\u0642\u06cc\u0642 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u062f.<\/li>\n<\/ul>\n<\/li>\n<li><strong>\u0645\u0633\u0626\u0644\u0647<\/strong>: \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0646\u0627\u062f\u0631\u0633\u062a \u0686\u0627\u0631\u0686\u0648\u0628\n<ul>\n<li><strong>\u0631\u0627\u0647 \u062d\u0644<\/strong>: \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0646\u0627\u0633\u0628 \u0631\u0627 \u0627\u0639\u0645\u0627\u0644 \u06a9\u0646\u06cc\u062f \u0648 \u0628\u0647 \u0637\u0648\u0631 \u0645\u0646\u0638\u0645 \u0686\u0627\u0631\u0686\u0648\u0628 \u0631\u0627 \u0628\u0647 \u0646\u0633\u062e\u0647 \u0647\u0627\u06cc \u0648\u0635\u0644\u0647 \u0634\u062f\u0647 \u0628\u0647 \u0631\u0648\u0632 \u06a9\u0646\u06cc\u062f.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>\u0648\u06cc\u0698\u06af\u06cc \u0647\u0627\u06cc \u0627\u0635\u0644\u06cc \u0648 \u0645\u0642\u0627\u06cc\u0633\u0647 \u0647\u0627\u06cc \u062f\u06cc\u06af\u0631 \u0628\u0627 \u0627\u0635\u0637\u0644\u0627\u062d\u0627\u062a \u0645\u0634\u0627\u0628\u0647 \u062f\u0631 \u0642\u0627\u0644\u0628 \u062c\u062f\u0627\u0648\u0644 \u0648 \u0641\u0647\u0631\u0633\u062a<\/h2>\n<table>\n<thead>\n<tr>\n<th>\u0648\u06cc\u0698\u06af\u06cc<\/th>\n<th>\u062a\u0632\u0631\u06cc\u0642 OGNL<\/th>\n<th>\u062a\u0632\u0631\u06cc\u0642 SQL<\/th>\n<th>\u062a\u0632\u0631\u06cc\u0642 \u0641\u0631\u0645\u0627\u0646<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u0647\u062f\u0641 \u062d\u0645\u0644\u0647<\/td>\n<td>\u0639\u0628\u0627\u0631\u0627\u062a OGNL<\/td>\n<td>\u067e\u0631\u0633 \u0648 \u062c\u0648\u0647\u0627\u06cc SQL<\/td>\n<td>\u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0633\u06cc\u0633\u062a\u0645<\/td>\n<\/tr>\n<tr>\n<td>\u062a\u0623\u062b\u06cc\u0631<\/td>\n<td>\u0628\u0627\u0644\u0627<\/td>\n<td>\u0628\u0627\u0644\u0627<\/td>\n<td>\u0628\u0627\u0644\u0627<\/td>\n<\/tr>\n<tr>\n<td>\u067e\u06cc\u0686\u06cc\u062f\u06af\u06cc<\/td>\n<td>\u0645\u062a\u0648\u0633\u0637 \u062a\u0627 \u0632\u06cc\u0627\u062f<\/td>\n<td>\u062f\u0631 \u062d\u062f \u0645\u062a\u0648\u0633\u0637<\/td>\n<td>\u062f\u0631 \u062d\u062f \u0645\u062a\u0648\u0633\u0637<\/td>\n<\/tr>\n<tr>\n<td>\u06a9\u0627\u0647\u0634 \u0645\u0639\u0645\u0648\u0644\u06cc<\/td>\n<td>\u0627\u0639\u062a\u0628\u0627\u0631 \u0633\u0646\u062c\u06cc \u0648\u0631\u0648\u062f\u06cc<\/td>\n<td>\u0628\u06cc\u0627\u0646\u06cc\u0647 \u0647\u0627\u06cc \u0622\u0645\u0627\u062f\u0647 \u0634\u062f\u0647<\/td>\n<td>\u0627\u0639\u062a\u0628\u0627\u0631 \u0633\u0646\u062c\u06cc \u0648\u0631\u0648\u062f\u06cc\u060c \u0641\u0631\u0627\u0631<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u062f\u06cc\u062f\u06af\u0627\u0647 \u0647\u0627 \u0648 \u0641\u0646\u0627\u0648\u0631\u06cc \u0647\u0627\u06cc \u0622\u06cc\u0646\u062f\u0647 \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 \u062a\u0632\u0631\u06cc\u0642 OGNL<\/h2>\n<p>\u062a\u0648\u0633\u0639\u0647 \u0645\u062f\u0627\u0648\u0645 \u062f\u0631 \u0686\u0627\u0631\u0686\u0648\u0628 \u0647\u0627\u06cc \u0648\u0628 \u0648 \u0632\u0628\u0627\u0646 \u0647\u0627\u06cc \u0628\u0631\u0646\u0627\u0645\u0647 \u0646\u0648\u06cc\u0633\u06cc \u0628\u0647 \u0637\u0648\u0631 \u0645\u062f\u0627\u0648\u0645 \u0686\u0634\u0645 \u0627\u0646\u062f\u0627\u0632 \u062a\u0647\u062f\u06cc\u062f \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u0645\u06cc \u062f\u0647\u062f\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u062a\u0632\u0631\u06cc\u0642 OGNL. \u062f\u06cc\u062f\u06af\u0627\u0647 \u0647\u0627\u06cc \u0622\u06cc\u0646\u062f\u0647 \u0639\u0628\u0627\u0631\u062a\u0646\u062f \u0627\u0632:<\/p>\n<ul>\n<li><strong>\u062a\u06a9\u0646\u06cc\u06a9 \u0647\u0627\u06cc \u062a\u0634\u062e\u06cc\u0635 \u067e\u06cc\u0634\u0631\u0641\u062a\u0647<\/strong>: \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u06cc\u0627\u062f\u06af\u06cc\u0631\u06cc \u0645\u0627\u0634\u06cc\u0646 \u0648 \u0647\u0648\u0634 \u0645\u0635\u0646\u0648\u0639\u06cc \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0648 \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u062a\u0632\u0631\u06cc\u0642 OGNL.<\/li>\n<li><strong>\u0628\u0647\u0628\u0648\u062f \u0686\u0627\u0631\u0686\u0648\u0628<\/strong>: \u0633\u0627\u062e\u062a \u0686\u0627\u0631\u0686\u0648\u0628 \u0647\u0627\u06cc \u0627\u0645\u0646 \u062a\u0631 \u06a9\u0647 \u0630\u0627\u062a\u0627\u064b \u062e\u0637\u0631 \u062a\u0632\u0631\u06cc\u0642 OGNL \u0631\u0627 \u0628\u0647 \u062d\u062f\u0627\u0642\u0644 \u0645\u06cc \u0631\u0633\u0627\u0646\u062f.<\/li>\n<li><strong>\u0622\u06af\u0627\u0647\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc<\/strong>: \u0627\u0641\u0632\u0627\u06cc\u0634 \u0622\u0645\u0648\u0632\u0634 \u0648 \u0622\u06af\u0627\u0647\u06cc \u062f\u0631 \u0628\u06cc\u0646 \u062a\u0648\u0633\u0639\u0647 \u062f\u0647\u0646\u062f\u06af\u0627\u0646 \u062f\u0631 \u0645\u0648\u0631\u062f \u0634\u06cc\u0648\u0647 \u0647\u0627\u06cc \u06a9\u062f\u06af\u0630\u0627\u0631\u06cc \u0627\u0645\u0646.<\/li>\n<\/ul>\n<h2>\u0686\u06af\u0648\u0646\u0647 \u0645\u06cc \u062a\u0648\u0627\u0646 \u0627\u0632 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u067e\u0631\u0648\u06a9\u0633\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f \u06cc\u0627 \u0628\u0627 \u062a\u0632\u0631\u06cc\u0642 OGNL \u0645\u0631\u062a\u0628\u0637 \u0634\u062f<\/h2>\n<p>\u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u067e\u0631\u0648\u06a9\u0633\u06cc \u0645\u0627\u0646\u0646\u062f \u0622\u0646\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 OneProxy \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc \u0634\u0648\u062f \u0645\u06cc \u062a\u0648\u0627\u0646\u0646\u062f \u062f\u0631 \u0645\u0648\u0631\u062f \u062a\u0632\u0631\u06cc\u0642 OGNL \u0647\u0645 \u062f\u0631 \u062d\u0645\u0644\u0647 \u0648 \u0647\u0645 \u062f\u0631 \u062f\u0641\u0627\u0639 \u0646\u0642\u0634 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f:<\/p>\n<ul>\n<li><strong>\u0646\u0642\u0634 \u062f\u0641\u0627\u0639\u06cc<\/strong>: \u0628\u0627 \u0627\u0633\u062a\u0642\u0631\u0627\u0631 \u06cc\u06a9 \u0633\u0631\u0648\u0631 \u067e\u0631\u0648\u06a9\u0633\u06cc \u0628\u0627 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0645\u0646\u0627\u0633\u0628\u060c \u0633\u0627\u0632\u0645\u0627\u0646 \u0647\u0627 \u0645\u06cc \u062a\u0648\u0627\u0646\u0646\u062f \u062a\u0631\u0627\u0641\u06cc\u06a9 \u0631\u0627 \u0641\u06cc\u0644\u062a\u0631 \u0648 \u0646\u0638\u0627\u0631\u062a \u06a9\u0646\u0646\u062f\u060c \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u06cc\u06a9 \u0644\u0627\u06cc\u0647 \u062d\u0641\u0627\u0638\u062a\u06cc \u0627\u0636\u0627\u0641\u06cc \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u062a\u0632\u0631\u06cc\u0642 OGNL \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc \u062f\u0647\u0646\u062f.<\/li>\n<li><strong>\u0646\u0642\u0634 \u062a\u0647\u0627\u062c\u0645\u06cc<\/strong>: \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0632 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u067e\u0631\u0627\u06a9\u0633\u06cc \u0628\u0631\u0627\u06cc \u0645\u062e\u0641\u06cc \u06a9\u0631\u062f\u0646 \u0647\u0648\u06cc\u062a \u062e\u0648\u062f \u062f\u0631 \u062d\u06cc\u0646 \u0627\u0646\u062c\u0627\u0645 \u06cc\u06a9 \u062d\u0645\u0644\u0647 \u062a\u0632\u0631\u06cc\u0642 OGNL \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u0646\u062f \u06a9\u0647 \u062a\u0634\u062e\u06cc\u0635 \u0648 \u0627\u0646\u062a\u0633\u0627\u0628 \u0631\u0627 \u062f\u0634\u0648\u0627\u0631\u062a\u0631 \u0645\u06cc \u06a9\u0646\u062f.<\/li>\n<\/ul>\n<h2>\u0644\u06cc\u0646\u06a9 \u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637\u0647<\/h2>\n<ol>\n<li><a href=\"https:\/\/struts.apache.org\/security\/\" target=\"_new\" rel=\"noopener nofollow\">\u0628\u0648\u0644\u062a\u0646 \u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc Apache Struts<\/a><\/li>\n<li><a href=\"https:\/\/owasp.org\/www-project-web-security-testing-guide\/latest\/4-Web_Application_Security_Testing\/07-Input_Validation_Testing\/12-Testing_for_OGNL_Injection\" target=\"_new\" rel=\"noopener nofollow\">\u0631\u0627\u0647\u0646\u0645\u0627\u06cc OWASP \u062f\u0631 \u0645\u0648\u0631\u062f \u0622\u0632\u0645\u0627\u06cc\u0634 \u0628\u0631\u0627\u06cc \u062a\u0632\u0631\u06cc\u0642 OGNL<\/a><\/li>\n<li><a href=\"https:\/\/cwe.mitre.org\/data\/definitions\/917.html\" target=\"_new\" rel=\"noopener nofollow\">\u062c\u0632\u0626\u06cc\u0627\u062a CWE \u062f\u0631 \u0645\u0648\u0631\u062f \u062a\u0632\u0631\u06cc\u0642 OGNL<\/a><\/li>\n<\/ol>\n<p>\u0627\u06cc\u0646 \u0631\u0627\u0647\u0646\u0645\u0627\u06cc \u06af\u0633\u062a\u0631\u062f\u0647\u060c \u062f\u0631\u06a9 \u062c\u0627\u0645\u0639\u06cc \u0627\u0632 \u062a\u0632\u0631\u06cc\u0642 OGNL \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u062a\u0627\u0631\u06cc\u062e\u0686\u0647\u060c \u0645\u06a9\u0627\u0646\u06cc\u0633\u0645\u200c\u0647\u0627\u060c \u0648\u06cc\u0698\u06af\u06cc\u200c\u0647\u0627\u060c \u0627\u0646\u0648\u0627\u0639 \u0648 \u0627\u0631\u062a\u0628\u0627\u0637 \u0622\u0646 \u0628\u0627 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u067e\u0631\u0627\u06a9\u0633\u06cc \u0645\u0627\u0646\u0646\u062f OneProxy \u0631\u0627 \u0628\u0631\u062c\u0633\u062a\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0645\u0631 \u0628\u0631 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u0642\u062f\u0627\u0645\u0627\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc \u0642\u0648\u06cc \u0628\u0631\u0627\u06cc \u062f\u0641\u0627\u0639 \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u0686\u0646\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a \u067e\u06cc\u0686\u06cc\u062f\u0647 \u0648 \u0628\u0633\u06cc\u0627\u0631 \u0645\u062e\u0631\u0628\u06cc \u062a\u0627\u06a9\u06cc\u062f \u0645\u06cc \u06a9\u0646\u062f.<\/p>","protected":false},"featured_media":478258,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-478257","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>OGNL Injection<\/mark>","faq_items":[{"question":"What is OGNL Injection?","answer":"<p>OGNL Injection is a type of security vulnerability that allows an attacker to execute arbitrary code on a web application's server by exploiting OGNL expressions, which are commonly used in certain web frameworks like Apache Struts. The impact can range from unauthorized information disclosure to complete system compromise.<\/p>"},{"question":"What are the main types of OGNL Injection?","answer":"<p>There are primarily two types of OGNL Injection: Classic OGNL Injection, which exploits insecure handling of user inputs and leads to arbitrary code execution, and Blind OGNL Injection, a stealthier variant where the attacker gains information through indirect means, such as response times.<\/p>"},{"question":"How does OGNL Injection work?","answer":"<p>OGNL Injection occurs when an attacker injects malicious OGNL expressions into the application's input, which the server then parses and evaluates. This leads to the execution of arbitrary code on the server, and the attacker may gain unauthorized control or access to sensitive data.<\/p>"},{"question":"What are the key features of OGNL Injection?","answer":"<p>The key features of OGNL Injection include its versatility in malicious purposes, the complexity in crafting malicious expressions, the high impact resulting from a successful attack, and the difficulty in mitigating the vulnerability.<\/p>"},{"question":"How can OGNL Injection be prevented?","answer":"<p>OGNL Injection can be prevented by implementing strict input validation and sanitization, applying proper security configurations, and regularly updating the framework to patched versions.<\/p>"},{"question":"How is OGNL Injection different from other injections like SQL Injection?","answer":"<p>While OGNL Injection targets OGNL expressions and can lead to arbitrary code execution, SQL Injection targets SQL queries and can manipulate database queries. Command Injection, on the other hand, targets system commands. The impact is high for all these injections, but the targets and mitigation strategies vary.<\/p>"},{"question":"What are the future perspectives related to OGNL Injection?","answer":"<p>Future perspectives related to OGNL Injection include the development of advanced detection techniques using machine learning and AI, enhancements in web frameworks to minimize the risk, and increasing security awareness among developers.<\/p>"},{"question":"How can proxy servers like OneProxy be associated with OGNL Injection?","answer":"<p>Proxy servers like OneProxy can play a defensive role by filtering and monitoring traffic to provide protection against OGNL Injection. Conversely, attackers might also use proxy servers to hide their identity while conducting an OGNL Injection attack.<\/p>"},{"question":"Where can I find more information about OGNL Injection?","answer":"<p>You can find more information about OGNL Injection from sources like Apache Struts Security Bulletins, the OWASP Guide on Testing for OGNL Injection, and CWE details on OGNL Injection, all of which provide detailed insights into the vulnerability.<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/ir\/wp-json\/wp\/v2\/wiki\/478257","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/ir\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/ir\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/ir\/wp-json\/wp\/v2\/wiki\/478257\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/ir\/wp-json\/wp\/v2\/media\/478258"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/ir\/wp-json\/wp\/v2\/media?parent=478257"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}