Purpose, just a POC (for now) to automatically and periodically find some CVE tags in the maven repository.

我可以通过浏览器和mvn很好地访问maven,但无法通过Java访问maven,我缺少什么?我try 过UrlConnection、HttpsURLConnection、有无GET、Content type、User Agent和Accept,对于我try 的所有地址,它总是返回403,同样的代码在其他网站(如"cve.mitre.org"或"nvd.nist.gov")上运行良好,但在以下情况下失败:https://mvnrepository.com/artifact/log4j/apache-log4j-extras/1.2.17".

我的URL是动态构建的,以"**https://mvnrepository.com/artifact/**""开头,然后添加组、名称和版本,将其转换为有效地址,如https://mvnrepository.com/artifact/log4j/apache-log4j-extras/1.2.17"

    System.setProperty("https.proxyHost", "xxxx");
    System.setProperty("https.proxyPort", "xxxx");

    String content = null;
    try {
        URL obj = new URL(address);
        HttpsURLConnection con = (HttpsURLConnection) obj.openConnection();
        con.setRequestMethod("GET");
        con.setRequestProperty("Content-Type", "application/json");
        con.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36");
        con.setRequestProperty("Accept", "*/*");

        con.connect();
        
        BufferedReader br;
        
        if (con.getResponseCode() < 300) {
            br = new BufferedReader(new InputStreamReader(con.getInputStream(), StandardCharsets.UTF_8));
        } else {
            br = new BufferedReader(new InputStreamReader(con.getErrorStream(), StandardCharsets.UTF_8));
        }            

        final StringBuilder sb = new StringBuilder();
        String line;
        while ((line = br.readLine()) != null) {
            sb.append(line);
        }
        br.close();

推荐答案

This web use anti-bot security CloudFlare.
How to bypass CloudFlare bot protection?
It depends.... Sometimes it is very difficult task or impossible. That you need to do, is simulate a real user with the browser.
With htmlunit browser you can bypass it in this case only and with a good IP address. (i use my own ip address and did only one request)

您需要maven依赖项:

<dependency>
    <groupId>net.sourceforge.htmlunit</groupId>
    <artifactId>htmlunit</artifactId>
    <version>2.57.0</version>
</dependency>

这里有一些java示例:

import com.gargoylesoftware.htmlunit.WebClient;
import com.gargoylesoftware.htmlunit.html.HtmlAnchor;
import com.gargoylesoftware.htmlunit.html.HtmlPage;
import java.io.IOException;
import java.net.URL;
import java.util.List;

public class Maven {

    public static void main(String[] args) throws IOException {

        try (final WebClient webClient = new WebClient()) {
            webClient.getOptions().setJavaScriptEnabled(false);
            URL target = new URL("https://mvnrepository.com/artifact/log4j/apache-log4j-extras/1.2.17");
            final HtmlPage page = webClient.getPage(target);
            List<HtmlAnchor> elements = page.getByXPath("//a[contains(@class, 'vuln')]");
            elements.forEach(element -> System.out.println(element.getTextContent()));
        }
    }
}

OUTPUT:

CVE-2022-23305
CVE-2022-23302
CVE-2021-4104
CVE-2019-17571
View 1 more ...
4 vulnerabilities 

我希望我能帮助你.

Java相关问答推荐

CriteriaQuery with max

Javascript更新alert 可扩展内容样式与CSS—按钮更多/更少

使用java访问具体子类特定方法的最佳方法是什么?

为什么Java的代码工作(if condition内部的实例)

如何配置ActiveMQ Artemis以使用AMQP 1.0和其他协议与Java

@org.springframework.beans.factory.annotation.Autowired(required=true)-注入点有以下注释:-SpringBoot

如何判断一个矩阵是否为有框矩阵?

在Java中,如何按一个属性升序,然后按另一个属性降序对对象列表进行排序?

为什么Spring Boot项目无法为基于MySQL的CRUD应用程序找到从JPARepository接口扩展的ProductRepository?

将Spring Boot 3.2.0升级到3.2.1后查询执行错误

Java Mooc.fi Part 12_01.Hideout -返回和删除方法

搜索列表返回多个频道

Android Java:已设置但未读取SharedPreferences

无法播放音频:从资源加载库GStreamer-Lite失败

在使用具有不同成本的谓词调用allMatch之前对Java流进行排序会带来什么好处吗?

循环不起作用只有第一个元素重复

将@Transactional添加到Spring框架中链下的每个方法会产生什么效果?

Springboot应用程序无法识别任何@RestController或@Service,我认为@Repository也无法识别

如何使用java区分以下结果

关于正则表达式的一个特定问题,该问题与固定宽度负向后看有关