apache2.2+tomcat6.0+.htaccess实现二级域名

2011-03-08 11:56:40 144 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

文件上传漏洞攻防实战：从WebShell到防御体系构建在Web应用安全领域，文件上传功能是常见的高危攻击面。其核心原理在于攻击者利用应用对用户上传文件的处理逻辑缺陷，将恶意文件上传至服务器并执行，从而获取系统控制权。这种漏洞的技术价值在于它直接关联服务器安全，常被用于获取WebShell，进而实施数据窃取、内网渗透等深度攻击。典型的应用场景包括用户头像上传、文档分享、富文本编辑器附件等交互功能。攻击者常通过解析漏洞、文件包含、条件竞争等手法绕过校验，其中WebShell上传是常见目标。本文聚焦文件上传漏洞的攻防对抗，深入剖析其利用手法与多层次防御策略，为开发与阅读详情

httpd.conf文件
LoadModule jk_module "modules/mod_jk.so"
# Where to find workers.properties
JkWorkersFile "conf/workers.properties"
# Where to put jk logs
JkLogFile "logs/mod_jk.log"
# Set the jk log level [debug/error/info]
JkLogLevel info
# Select the log format
JkLogStampFormat "[%a %b %d %H:%M:%S %Y]"
# JkOptions indicate to send SSL KEY SIZE,
JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories
# JkRequestLogFormat set the request format
JkRequestLogFormat "%w %V %T"
JkMount /*.jsp worker1
# 转发某个目录下的（此例为：/example）所有文件给tomcat：
JkMount /servlet/* worker1
JkMount /dwr/* worker1
JkMount /*.properties worker1
#设置相关文件交由由ajp13处理
JkMount /*.html worker1

JkMount /*.jsp worker1

workers.properties文件配置
#下面是Tomcat实例列表即不同的Tomcat服务器
worker.list=worker1

#tomcat1 实例配置，此实例的名字就叫做tomcat1

worker.worker1.host=www.care-baby.com.cn

worker.worker1.port=8080

worker.worker1.type=ajp13

worker.worker1.lbfactor=50

worker.worker1.cachesize=10

worker.worker1.cache_timeout=600

worker.worker1.socket_keepalive=1

worker.worker1.socket_timeout=300

Tomcat/conf/server.xml
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
maxThreads="1000" minSpareThreads="50" maxidleTime="600000"/>

<Connector executor="tomcatThreadPool"
port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
<Host name="www.care-baby.com.cn" appBase="webapps"
unpackWARs="true" autoDeploy="true"
xmlValidation="false" xmlNamespaceAware="false">
<Context path="/" docBase="C:\Program Files\Apache Software Foundation\Tomcat 6.0\webapps\care-baby" debug="0" reloadable="true" crossContext="true"/>
<Resource name="jdbc/DBUTIL" auth="Container"
type="javax.sql.DataSource" driverClassName="com.microsoft.sqlserver.jdbc.SQLServerDriver"
url="jdbc:microsoft:sqlserver://localhost:1433;databasename=carebabydb" username="sa"
password="sa" maxActive="1000" maxIdle="500" maxWait="-1" />
</Host>
.htaccess文件
RewriteEngine on
RewriteBase /
DirectoryIndex /loginnet/login.jsp
#让www.care-baby.com.cn访问 loginnet/login.jsp
RewriteCond %{HTTP_HOST} ^www.care-baby.com.cn$
RewriteCond %{REQUEST_URI} !^/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /$1
RewriteCond %{HTTP_HOST} ^www.care-baby.com.cn$
RewriteRule ^(/)?$ /login.jsp [L]
#让所有的二级域名都访问 loginnet/transit.jsp
RewriteCond %{HTTP_HOST} ^ly.care-baby.com.cn$
RewriteCond %{REQUEST_URI} !^/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /$1
RewriteCond %{HTTP_HOST} ^ly.care-baby.com.cn$
RewriteRule ^(/)?$ /loginnet/transit.jsp [L]
为什么访问www.care-baby.com.cn
Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, webmaster@dummy-host.care-baby.com.cn and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.
这个问题

...全文