最近公司有个项目被客户拿去进行漏洞扫描，发现用户登录太简单，容易被暴力破解。当然发现的问题很多，什么反射型XSS，存储型XSS，敏感信息泄露等等。但是我们今天不讲这么多，就说说如何修复暴力破解的问题。由于登录界面未设置图形验证码，也没有对同一用户在连续登录错误时进行限制，导致攻击者可以尝试破解任意已知用户的密码。所以针对这种情况，第一，对同一用户连续登录在规定时间内的次数进行限制，超过则锁定用户。第二，添加图形验证码。
首先给你们看看我的项目结构：
user.sql数据：
SET FOREIGN_KEY_CHECKS=0; -- ---------------------------- -- Table structure for user -- ---------------------------- DROP TABLE IF EXISTS `user`; CREATE TABLE user ( `id` bigint(20) NOT NULL AUTO_INCREMENT, `username` varchar(50) NOT NULL COMMENT '用户名', `password` varchar(32) NOT NULL COMMENT '密码，加密存储', `islocked` varchar(10) DEFAULT "0" COMMENT '是否锁定', `firsttime` varchar(50) DEFAULT NULL COMMENT '第一次登录错误时间', `count` varchar(10) DEFAULT NULL COMMENT '登录错误次数', PRIMARY KEY (`id`), UNIQUE KEY `username` (`username`) USING BTREE ) ENGINE=InnoDB AUTO_INCREMENT=37 DEFAULT CHARSET=utf8 COMMENT='用户表'; -- ---------------------------- -- Records of user -- ---------------------------- INSERT INTO user VALUES (null, 'admin', 'e10adc3949ba59abbe56e057f20f883e', '0', null, null); INSERT INTO user VALUES (null, 'nanshan', 'e10adc3949ba59abbe56e057f20f883e', '0', null, null);
新建数据库test,导入user.sql即可。
web层：
VerifyCodeServlet.java
package cn.itcast.com.servlet; import java.io.IOException; import javax.servlet.ServletException; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import cn.itcast.com.util.VerifyCodeUtils; /** * * @author saule * @date 2019年6月28日 下午11:39:19 * @Description 验证码servlet */ public class VerifyCodeServlet extends HttpServlet { private static final long serialVersionUID = 1L; public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { doPost(request, response); } public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { int width = 100; int height = 35; //获取验证码 String verifyCode = VerifyCodeUtils.generateVerifyCode(4); //将验证码保存到session request.getSession().setAttribute("verifyCode", verifyCode); //向页面输出验证码 VerifyCodeUtils.outputImage(width, height, response.getOutputStream(), verifyCode); } }
LoginServlet.java
package cn.itcast.com.servlet; import java.io.IOException; import java.util.HashMap; import java.util.Map; import javax.servlet.ServletException; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import net.sf.json.JSONArray; import cn.itcast.com.pojo.User; import cn.itcast.com.service.UserService; /** * 正常用户登录流程： * 1，判断验证码是否正确。 * 2，判断用户是否锁定。 * 3，根据用户名称查找，判断用户是否存在。 * 4，判断密码是否正确。 */ public class LoginServlet extends HttpServlet { private static final long serialVersionUID = 1L; public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { response.setContentType("text/xml;charset=utf-8"); String username=request.getParameter("username"); String password=request.getParameter("password"); String vercode=request.getParameter("vercode"); String sessionCode=(String) request.getSession().getAttribute("verifyCode"); //清除session中的验证码 request.getSession().removeAttribute("verifyCode"); Map<String,String> map=new HashMap<>(); //验证码错误 if(sessionCode!=null && !sessionCode.equals(vercode.toUpperCase())){ map.put("errcode", "0"); // 转换成json String json = JSONArray.fromObject(map).toString(); response.getWriter().write(json); response.getWriter().close(); return; } System.out.println(username+":"+password); UserService userService=new UserService(); User loginUser=new User(); loginUser.setUsername(username); loginUser.setPassword(password); Map<String, Object> result = userService.login(loginUser); if(result.get("errcode").equals("4")){//验证成功 request.getSession().setAttribute("username", username); request.getSession().setAttribute("password", password);
//用ajax请求用户登录，重定向和转发都是失效的。 //request.getRequestDispatcher("/WEB-INF/success.jsp").forward(request, response); } // 转换成json String json = JSONArray.fromObject(result).toString(); response.getWriter().write(json); response.getWriter().close(); } public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { doGet(request, response); } }
Service层：
UserService.java
package cn.itcast.com.service; import java.text.ParseException; import java.text.SimpleDateFormat; import java.util.Date; import java.util.HashMap; import java.util.Map; import cn.itcast.com.dao.UserDao; import cn.itcast.com.pojo.User; import cn.itcast.com.util.Md5Utils; /** * * @author saule * @date 2019年6月27日 上午10:50:44 * @Description */ public class UserService { private static final String USER_NOT_EXIST="1"; private static final String USER_IS_LOCK="2"; private static final String PASSWORD_ERROR="3"; private static final String VERIFICATION_SUCCESS="4"; SimpleDateFormat sdf=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); //登录操作 public Map<String,Object> login(User loginUser) { Map<String,Object> loginMap=new HashMap<String, Object>(); UserDao userDao=new UserDao(); User user=userDao.findByName(loginUser.getUsername()); String pwd = Md5Utils.md5(loginUser.getPassword()); if(user==null){//用户不存在 loginMap.put("errcode", USER_NOT_EXIST); }else if(user.getIslocked().equals("1")){//用户被锁定 loginMap.put("errcode", USER_IS_LOCK); }else if(!user.getPassword().equals(pwd)){//密码错误 //超过规定时间，次数不超过4次登录时，将时间与次数重置。 if(user.getFirsttime()!=null){ try { long firsttime=sdf.parse(user.getFirsttime()).getTime(); long nowtime=new Date().getTime(); if((nowtime-firsttime)>5*60*1000){ user.setFirsttime(null); user.setCount("0"); userDao.update(user); } } catch (ParseException e) { e.printStackTrace(); } } if(user.getFirsttime()==null){//初次登录密码错误，记录数据。 user.setFirsttime(sdf.format(new Date())); user.setCount("1"); userDao.update(user); }else if(user.getFirsttime()!=null && Integer.valueOf(user.getCount())<3){//连续登陆错误次数小于4次 String newCount = String.valueOf(Integer.valueOf(user.getCount())+1); user.setCount(newCount); userDao.update(user); }else{//大于4次且时间间隔小于5分钟则锁定用户。禁止登录。 try { long firsttime=sdf.parse(user.getFirsttime()).getTime(); long nowtime=new Date().getTime(); if((nowtime-firsttime)<5*60*1000){ user.setFirsttime(null); user.setCount("0"); user.setIslocked("1");//1表示锁定用户 userDao.update(user); } } catch (ParseException e) { e.printStackTrace(); } } loginMap.put("errcode", PASSWORD_ERROR); loginMap.put("user", user); }else{ loginMap.put("errcode", VERIFICATION_SUCCESS); } return loginMap; } }
Dao层：
UserDao.java
package cn.itcast.com.dao; import java.sql.Connection; import java.sql.PreparedStatement; import java.sql.ResultSet; import java.sql.SQLException; import cn.itcast.com.pojo.User; import cn.itcast.com.util.JdbcUtils; public class UserDao { //根据用户查询 public User findByName(String username) { Connection conn=null; PreparedStatement pst=null; ResultSet rs=null; String sql="select * from user where username=?"; try { conn=JdbcUtils.getConnection(); pst=conn.prepareStatement(sql); pst.setString(1, username); rs=pst.executeQuery(); if(rs.next()){ User user=new User(); user.setId(rs.getInt("id")); user.setUsername(rs.getString("username")); user.setPassword(rs.getString("password")); user.setIslocked(rs.getString("islocked")); user.setFirsttime(rs.getString("firsttime")); user.setCount(rs.getString("count")); return user; } } catch (SQLException e) { e.printStackTrace(); }finally{ try { JdbcUtils.close(conn, pst, rs); } catch (SQLException e) { e.printStackTrace(); } } return null; } //修改用户信息 public void update(User user) { Connection conn=null; PreparedStatement pst=null; String sql="update user set islocked=?,firsttime=?,count=? where id=?"; try { conn=JdbcUtils.getConnection(); pst = conn.prepareStatement(sql); pst.setString(1, user.getIslocked()); pst.setString(2, user.getFirsttime()); pst.setString(3, user.getCount()); pst.setInt(4, user.getId()); int row = pst.executeUpdate(); if(row!=0){ System.out.println("修改成功"); } } catch (SQLException e) { e.printStackTrace(); }finally{ try { JdbcUtils.close(conn, pst, null); } catch (SQLException e) { e.printStackTrace(); } } } }
实体类：
user.java
package cn.itcast.com.pojo; public class User { private Integer id; private String username; private String password; private String islocked;//是否锁定，0表示没有锁定；1表示锁定； private String firsttime; private String count;//连续登录错误次数 public Integer getId() { return id; } public void setId(Integer id) { this.id = id; } public String getUsername() { return username; } public void setUsername(String username) { this.username = username; } public String getPassword() { return password; } public void setPassword(String password) { this.password = password; } public String getIslocked() { return islocked; } public void setIslocked(String islocked) { this.islocked = islocked; } public String getFirsttime() { return firsttime; } public void setFirsttime(String firsttime) { this.firsttime = firsttime; } public String getCount() { return count; } public void setCount(String count) { this.count = count; } }
帮助类：
VerifyCodeUtils.java
package cn.itcast.com.util; import javax.imageio.ImageIO; import java.awt.*; import java.awt.geom.AffineTransform; import java.awt.image.BufferedImage; import java.io.File; import java.io.FileOutputStream; import java.io.IOException; import java.io.OutputStream; import java.util.Arrays; import java.util.Random; /** * 验证码生成工具 * @author zl */ public class VerifyCodeUtils{ //使用到Algerian字体，系统里没有的话需要安装字体，字体只显示大写，去掉了1,0,i,o几个容易混淆的字符 public static final String VERIFY_CODES = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ"; private static Random random = new Random(); /** * 使用系统默认字符源生成验证码 * @param verifySize 验证码长度 * @return */ public static String generateVerifyCode(int verifySize){ return generateVerifyCode(verifySize, VERIFY_CODES); } /** * 使用指定源生成验证码 * @param verifySize 验证码长度 * @param sources 验证码字符源 * @return */ public static String generateVerifyCode(int verifySize, String sources){ if(sources == null || sources.length() == 0){ sources = VERIFY_CODES; } int codesLen = sources.length(); Random rand = new Random(System.currentTimeMillis()); StringBuilder verifyCode = new StringBuilder(verifySize); for(int i = 0; i < verifySize; i++){ verifyCode.append(sources.charAt(rand.nextInt(codesLen-1))); } return verifyCode.toString(); } /** * 生成随机验证码文件,并返回验证码值 * @param w * @param h * @param outputFile * @param verifySize * @return * @throws IOException */ public static String outputVerifyImage(int w, int h, File outputFile, int verifySize) throws IOException{ String verifyCode = generateVerifyCode(verifySize); outputImage(w, h, outputFile, verifyCode); return verifyCode; } /** * 输出随机验证码图片流,并返回验证码值 * @param w * @param h * @param os * @param verifySize * @return * @throws IOException */ public static String outputVerifyImage(int w, int h, OutputStream os, int verifySize) throws IOException{ String verifyCode = generateVerifyCode(verifySize); outputImage(w, h, os, verifyCode); return verifyCode; } /** * 生成指定验证码图像文件 * @param w * @param h * @param outputFile * @param code * @throws IOException */ public static void outputImage(int w, int h, File outputFile, String code) throws IOException{ if(outputFile == null){ return; } File dir = outputFile.getParentFile(); if(!dir.exists()){ dir.mkdirs(); } try{ outputFile.createNewFile(); FileOutputStream fos = new FileOutputStream(outputFile); outputImage(w, h, fos, code); fos.close(); } catch(IOException e){ throw e; } } /** * 输出指定验证码图片流 * @param w * @param h * @param os * @param code * @throws IOException */ public static void outputImage(int w, int h, OutputStream os, String code) throws IOException{ int verifySize = code.length(); BufferedImage image = new BufferedImage(w, h, BufferedImage.TYPE_INT_RGB); Random rand = new Random(); Graphics2D g2 = image.createGraphics(); g2.setRenderingHint(RenderingHints.KEY_ANTIALIASING,RenderingHints.VALUE_ANTIALIAS_ON); Color[] colors = new Color[5]; Color[] colorSpaces = new Color[] { Color.WHITE, Color.CYAN, Color.GRAY, Color.LIGHT_GRAY, Color.MAGENTA, Color.ORANGE, Color.PINK, Color.YELLOW }; float[] fractions = new float[colors.length]; for(int i = 0; i < colors.length; i++){ colors[i] = colorSpaces[rand.nextInt(colorSpaces.length)]; fractions[i] = rand.nextFloat(); } Arrays.sort(fractions); g2.setColor(Color.GRAY);// 设置边框色 g2.fillRect(0, 0, w, h); Color c = getRandColor(200, 250); g2.setColor(c);// 设置背景色 g2.fillRect(0, 2, w, h-4); //绘制干扰线 Random random = new Random(); g2.setColor(getRandColor(160, 200));// 设置线条的颜色 for (int i = 0; i < 20; i++) { int x = random.nextInt(w - 1); int y = random.nextInt(h - 1); int xl = random.nextInt(6) + 1; int yl = random.nextInt(12) + 1; g2.drawLine(x, y, x + xl + 40, y + yl + 20); } // 添加噪点 float yawpRate = 0.05f;// 噪声率 int area = (int) (yawpRate * w * h); for (int i = 0; i < area; i++) { int x = random.nextInt(w); int y = random.nextInt(h); int rgb = getRandomIntColor(); image.setRGB(x, y, rgb); } shear(g2, w, h, c);// 使图片扭曲 g2.setColor(getRandColor(100, 160)); int fontSize = h-4; Font font = new Font("Algerian", Font.ITALIC, fontSize); g2.setFont(font); char[] chars = code.toCharArray(); for(int i = 0; i < verifySize; i++){ AffineTransform affine = new AffineTransform(); affine.setToRotation(Math.PI / 4 * rand.nextDouble() * (rand.nextBoolean() ? 1 : -1), (w / verifySize) * i + fontSize/2, h/2); g2.setTransform(affine); g2.drawChars(chars, i, 1, ((w-10) / verifySize) * i + 5, h/2 + fontSize/2 - 10); } g2.dispose(); ImageIO.write(image, "jpg", os); } private static Color getRandColor(int fc, int bc) { if (fc > 255) fc = 255; if (bc > 255) bc = 255; int r = fc + random.nextInt(bc - fc); int g = fc + random.nextInt(bc - fc); int b = fc + random.nextInt(bc - fc); return new Color(r, g, b); } private static int getRandomIntColor() { int[] rgb = getRandomRgb(); int color = 0; for (int c : rgb) { color = color << 8; color = color | c; } return color; } private static int[] getRandomRgb() { int[] rgb = new int[3]; for (int i = 0; i < 3; i++) { rgb[i] = random.nextInt(255); } return rgb; } private static void shear(Graphics g, int w1, int h1, Color color) { shearX(g, w1, h1, color); shearY(g, w1, h1, color); } private static void shearX(Graphics g, int w1, int h1, Color color) { int period = random.nextInt(2); boolean borderGap = true; int frames = 1; int phase = random.nextInt(2); for (int i = 0; i < h1; i++) { double d = (double) (period >> 1) * Math.sin((double) i / (double) period + (6.2831853071795862D * (double) phase) / (double) frames); g.copyArea(0, i, w1, 1, (int) d, 0); if (borderGap) { g.setColor(color); g.drawLine((int) d, i, 0, i); g.drawLine((int) d + w1, i, w1, i); } } } private static void shearY(Graphics g, int w1, int h1, Color color) { int period = random.nextInt(40) + 10; // 50; boolean borderGap = true; int frames = 20; int phase = 7; for (int i = 0; i < w1; i++) { double d = (double) (period >> 1) * Math.sin((double) i / (double) period + (6.2831853071795862D * (double) phase) / (double) frames); g.copyArea(i, 0, 1, h1, 0, (int) d); if (borderGap) { g.setColor(color); g.drawLine(i, (int) d, i, 0); g.drawLine(i, (int) d + h1, i, h1); } } } public static void main(String[] args) throws IOException{ File dir = new File("F:/verifies"); int w = 200, h = 80; String verifyCode = generateVerifyCode(4); File file = new File(dir, verifyCode + ".jpg"); outputImage(w, h, file, verifyCode); } }
Md5Utils.java
package cn.itcast.com.util; import java.math.BigInteger; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; public class Md5Utils { /** * 使用md5的算法进行加密 */ public static String md5(String plainText) { byte[] secretBytes = null; try { secretBytes = MessageDigest.getInstance("md5").digest( plainText.getBytes()); } catch (NoSuchAlgorithmException e) { throw new RuntimeException("没有md5这个算法！"); } String md5code = new BigInteger(1, secretBytes).toString(16);// 16进制数字 // 如果生成数字未满32位，需要前面补0 for (int i = 0; i < 32 - md5code.length(); i++) { md5code = "0" + md5code; } return md5code; } }
JdbcUtils.java
package cn.itcast.com.util; import java.sql.Connection; import java.sql.DriverManager; import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; import java.util.ResourceBundle; /** * @author saule * @date 2019年6月27日 上午10:23:58 * @Description JDBC帮助类 */ public class JdbcUtils { private static String driver="com.mysql.jdbc.Driver"; private static String url="jdbc:mysql://localhost:3306/test?characterEncoding=utf-8"; private static String username="root"; private static String password="root"; static { try { // 将加载驱动操作，放置在静态代码块中.这样就保证了只加载一次. Class.forName(driver); } catch (ClassNotFoundException e) { e.printStackTrace(); } } public static Connection getConnection() throws SQLException { //获取连接 Connection con = DriverManager.getConnection(url, username, password); return con; } //关闭操作 public static void close(Connection con,Statement st,ResultSet rs) throws SQLException{ if(con!=null){ con.close(); }else if(st!=null){ st.close(); }else if(rs!=null){ rs.close(); } } }
web.xml
<?xml version="1.0" encoding="UTF-8"?> <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" id="WebApp_ID" version="3.0"> <display-name>youdu</display-name> <servlet> <servlet-name>VerifyCodeServlet</servlet-name> <servlet-class>cn.itcast.com.servlet.VerifyCodeServlet</servlet-class> </servlet> <servlet> <servlet-name>LoginServlet</servlet-name> <servlet-class>cn.itcast.com.servlet.LoginServlet</servlet-class> </servlet> <servlet-mapping> <servlet-name>VerifyCodeServlet</servlet-name> <url-pattern>/getVerifyCode</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>LoginServlet</servlet-name> <url-pattern>/login</url-pattern> </servlet-mapping> <welcome-file-list> <welcome-file>login.jsp</welcome-file> </welcome-file-list> </web-app>
前端页面：
login.jsp
<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>登录页面</title> <style type="text/css"> #login{ border: 1px solid deepskyblue; background-color: blanchedalmond; width:400px; height:250px; padding-left: 100px; padding-top: 50px; } </style> <script type="text/javascript"> //创建一个ajax对象 function getLoginAjax(){ var loginRequest; if(window.XMLHttpRequest){ loginRequest=new XMLHttpRequest(); }else if(window.ActiveXObject){//window对象中有ActiveXObject属性存在就是IE浏览器的低版本 try{ loginRequest= new ActiveXObject("Msxml2.XMLHTTP"); }catch(e){ loginRequest= new ActiveXObject("Microsoft.XMLHTTP"); } } return loginRequest; } //登录方法 function userlogin(){ //获取参数 var username=document.getElementById("username").value; var password=document.getElementById("password").value; var vercode=document.getElementById("vercode").value; /* 此处省略非空校验 */ var loginAjax=getLoginAjax(); loginAjax.open("POST", "login", true); //请求头 loginAjax.setRequestHeader("Content-Type","application/x-www-form-urlencoded"); loginAjax.send("username="+username+"&password="+password+"&vercode="+vercode); //设置回调函数 loginAjax.onreadystatechange = function() { //处理响应数据 当信息全部返回，并且是成功 if (loginAjax.readyState == 4 && loginAjax.status == 200) { //返回的数值类型一般是json格式，比较常见 console.log(); var jsonObj = eval("(" + loginAjax.responseText + ")"); for(var i=0;i<jsonObj.length;i++){ var errcode = jsonObj[i].errcode; if(errcode==0){ alert("验证码错误"); identifyload(); return false; }else if(errcode==1){ alert("用户不存在"); identifyload(); return false; }else if(errcode==2){ alert("用户被锁定，请联系管理。"); return false; }else if(errcode==3){ var user = jsonObj[i].user; var locked=user.islocked; var count=user.count; if(locked=='0' && count<4){ alert("密码错误,你还有"+(4-count)+"次机会"); identifyload(); }else if(locked=='1'){ alert("用户被锁定，请联系管理。"); } return false; }else if(errcode==4){ alert("登录成功"); window.location="http://localhost:8080/youdu/success.jsp"; } } } }; } function identifyload() { document.getElementById("imgcode").src = 'getVerifyCode?nowtime='+ new Date().getTime(); } </script> </head> <body> <div id="login"> <form action="./login" method="Post" name="login"> <table> <tr> <td>用户名:</td> <td> <input name="username" type="text" placeholder="请输入昵称" id="username"/><br/><br/> </td> </tr> <tr> <td>密码:</td> <td> <input name="password" type="password" placeholder="请输入密码" id="password"/><br/><br/> </td> </tr> <tr> <td>验证码:</td> <td> <input name="vercode" type="text" id="vercode"/> <img src="./getVerifyCode" height="32" id="imgcode" onclick="identifyload()" title="点击更换验证码"> </td> </tr> <tr> <td height="20"> </td> </tr> <tr> <td> <button type="button" value="登录" onclick="userlogin()">登录</button> <button type="reset" value="重置">重置</button> </td> </tr> </table> </form> </div> </body> </html>
success.jsp
<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>Insert title here</title> </head> <body> <h3>登录成功</h3> 用户名：${sessionScope.username} 密码：${sessionScope.password} </body> </html>
来个效果图：
最后说几句。虽然用户登录流程简单，但是用servlet和原生js、ajax实现还是有些坑的，特别是现在个个都习惯在框架下写代码，就比如ajax请求后，servlet重定向和转发都会失效，你得想办法登录成功后跳转系统页面。虽然都是比较基础的东西，对于初学者来说还是需要好好掌握。