JavaSec

0.For Me

Java(rep)00.1. Star ~

1.

• Java
  • :final static
• Java
• JNDI
• Java(pdf)
• ClassLoader()
• SPI
• JavaAgent
• Java9
• JMX
  • JMX
• JDWP
• Tomcatpipeline(Tomcat-Valve)
• ASM+Class+JVM
• Xpath
• JSTL()
• JEP290
• JavaXXE
  • XML (XML)
  • XMLXXE(XXE)
  • WAFXXE()
• Java00
• XSSNormalize
• -java()

2.

CCCBpJava(shareP)

• Java ()
• JavaURLDNS
• CommonsCollections1
• CommonsCollections2
• CommonsCollections3
• CommonsCollections5
• CommonsCollections6-HashSet
• CommonsCollections6-HashMap
• CommonsCollections6-Shiro1.2.4
• CommonsCollections7
• CommonCollectionsWithoutChainedTransformer
• TemplatesImplCommonsCollections2
• CommonsCollections11
• CommonsBeanutils1
• CommonsBeanutils1-Shiro(CC)
• [FileUpload1-](https://github.com/Y4tacker/JavaSec/blob/main/2./FileUpload/index.md)
• C3P0
• C3P0Tomcat(JNDI)
• Ysoserial0.0.6-JRMP
• SnakeYAMLGadget
• SnakeYAMLGadget(1.7)
• XStream
• serialVesionUID(BestMatchjbxz)
• ROME4400-1320(Base64)
• JDK7u21
• AspectJWeaver
• UTF-8 Overlong Encoding()
• javaclassgadget
  • URLDNSclass("DNS")
• SwingSSRF/RCE(JDK CVE-2023-21939)
• Hessian

  • Hessian

  • hessian-only-jdk

  • hessian-onlyjdk-jdk11+jdk.jfr.internal.Utils

3.Fastjson/Jackson

jacksonjacksonpayloadpayload

• Jackson

  • Jackson()

  • JacksonGadgets()

    • Jackson(demo)
    • JSON1JACKSON(JdkDynamicAopProxy)

• Fastjson

  • Fastjson

  • Fastjson1.1.15-1.2.4BCEL

  • Fastjson1.22-1.24JNDI

  • Fastjson1.22-1.24TemplateImpl

  • Fastjson1.2.25-1.2.41(L;autotype)

  • Fastjson1.2.25-1.2.42(L;autotype)

  • Fastjson1.2.25-1.2.43(autotype)

  • Fastjson1.2.25-1.2.45(mybatis3.x<3.5.0autotype)

  • Fastjson1.2.25-1.2.47

  • Fastjson1.2.48-1.2.68

  • Fastjson1.2.68refparseObjectget

  • blackhat2021fastjson1.2.68

  • 2021L3HCTFFastjson1.2.68

  • Trick

  • fastjson()

  • FastJson()

  • FastJson()

  • Fastjson()

  • Fastjson

• • Java JSON
  • fastjson
  • fastjsonclass/fastjsonjacksongson
  • Fastjson Gadget

4.Weblogic()

• T3

• CVE-2015-4852

• WeblogicClassLoaderRMI

• Weblogic SSRF Involving Deserialized JDBC Connection

5.

• ShellJAVAWEB

• JavaWebTomcat

• Tomcat-Listener

• Tomcat-Filter

• Tomcat-Servlet

• Tomcat-Valve

• Tomcat-Upgrade

• WebSocket

• Executor

• Java Agent ()

• SpringBoot-

• intercetorSpring

• Timer

• Jsp-Webshell(CTFphp)

• Jsp-WebShell

• Spring cloud gatewaySPEL

  • JavaSpring Cloud GatewayRedis

• Tools

  • Java ()

6.JavaAgent

• Java Instrument
• PreMainaddTransformerredefineClasses
• AgentMain(JVMInstrument)
• JVMTIC/C++JavaAgent

repoRaspLearning

7.Struts2

struts2OGNL(Ps:)

• Struts2
• S2-001()
• S2-002()
• S2-003()
• S2-005(Ognl_memberAccessacceptProperties)
• S2-007(OGNL)
• S2-008(devModeOgnl)

StrutsOgnl

• S2-015(setAllowStaticMethodAccess)
• S2-032(_memberAccessexcludedXXX/DefaultMemberAccessSecurityMemberAccess)
• S2-045(containerOgnlUtilSecurityMemberAccess)
• S2-057(#contextattrcontext)
• S2-066()

8.Tomcat

• JSTL

• jsp

• Tomcat

• Tomcat

• Java-waf(commons-fileupload)

• Tomcatwaf

• Tomcat.warJNDI

• Servlet

9.JDBC Attack

Make JDBC Attacks Brilliant Again JDBC Connection URL JDK JNDI

• MySQL-JDBC-

  • ()MySQL JDBC
  • fnmsddetectCustomCollations

• H2-RCE

• ModeShape-JNDI

• IBM DB2-JNDI

• Apache Derby

• SQLite SSRF

• PostgreSQL-RCE(poc)

  • Make JDBC Attacks Brilliant Again (Postgresql)

• Hive-RCE

• 2023BalckHat Asiainformix-sqlidb2cloudspanneravaticasnowflake

• JDBC

• JDBC Attack URL

10.JNDI

• Java RMI ()
• JDK JNDI
  • ()JDKJNDI
• JDK JNDI
• JNDI jdk Druid

11.Spring

• SpringWeb()
• SpringSecurityConstraint
• SpirngBootTomcatOOB
• SpringBoot-SpEL
• SpringCloud-SnakeYAML-RCE()
• Spring Boot Vulnerability Exploit Check List
• SSRF to Rce with Jolokia and Mbeans
• CVE-2022-22947 SpringCloudGateWay
• Spring Cloud Function-SPEL()
• SpringMVC(CVE-2010-1622)
• Spring Beans RCE(CVE-2022-22965)(Spring4shellAccessLogValveWBS)
• Spring Data MongoDB SpEL(CVE-2022-22980)()
• SpringBootFilterXSS
• Springboot devtools(secretactuator)
• SpringController(Hibernate Validator)

12.Shiro

• Shiro RememberMe ()
• Shiro
• Shirogadget
• CVE-2010-3863(/./admin/admin,/abc/../admin)
• CVE-2016-6802(/abc/../y4tacker/admin)
• Shiro550-TemplatesImpl(CC6-Shiro)
• CommonsBeanutils commons-collectionsShiro
• shirokey
• shiro--key
• Tomcat-Headershiro
• SpringShiro<1.5.0(/unauthorize/)
• CVE-2020-13933(/unauthorize/%3b)
• SpringBoot2.3.0Shiro<=1.5.1(/aa;/%2e%2e/unauthorize/unauthorize/;y4tacker/unauthorize)
• Spring-Shiro1.5.2 Bypass(/unauthorize/a%252Fa/unauthorize/*)
• Shiro (shiro 550payloadset)

13.

• -linux
• linuxjava
• Tomcat
• request

14. JSPWebshell

• JSP-Webshells()
• JspWebShell
• jspwebshell
• JspWebshell(unicodehtml)

15.Waf

• Java-waf(commons-fileupload)
• Javawaf
• Javawaf
• JavaWAF | (gv7.me)
• Java-()
• Fastjsonwaf
• RCE via SSTI on Spring Boot Error Page with Akamai WAF Bypass

16.

• Apache
  • Apache Commons Configuration (RCE)
  • Apache Spark shell command injection vulnerability via Spark UI()
  • Apache Commons JXPath
  • Apache Commons Text
  • Log4j2-RCE
    • Log4j2()
  • Apache Flink RCE via jar/plan API Endpoint in JDK8
  • Apache Dubbo CVE-2023-23638
  • Apache DubboCVE-2023-23638
  • Apache Airflow: Bypass permission verification to view task instances of other dags(CVE-2023-42663)
  • Apache Jackrabbit RMI (CVE-2023-37895)(RMI)
  • Apache ActiveMQ JolokiaJDK
  • Apache OFBiz
    • Apache OFBiz CVE-2023-49070 ()
    • Apache OFBiz(CVE-2023-51467)
• Oracle
  • Oracle E-Business Suite Unauthenticated RCE
  • Exploiting an Order of Operations Bug to Achieve RCE in Oracle Opera
  • Oracle Access Manager Pre-Auth RCE (CVE-202135587 Analysis)
• Spring
  • Spring-Kafka-POC-CVE-2023-34040
• Nacos
  • Aliababa Nacos hessian JRaft()
    • Nacos (WriteRequestsetOperation)()
• Adobe
  • CVE-2023-29298: Adobe ColdFusion Access Control Bypass
  • Analysis CVE-2023-29300: Adobe ColdFusion Pre-Auth RCE
• Smartbi
  • Smartbi
  • Smartbi(2)
  • Smartbi(3)
• CrushFTP
  • CrushFTP Unauthenticated Remote Code Execution(CVE-2023-43177)
  • CrushFTPVFS
  • CrushFTP Unauthenticated Remote Code Execution(CVE-2024-4040)
  • CrushFTP(CVE-2024-4040)
• Others
  • HtmlUnit-RCE
  • openfire(jetty%u002e)
  • Metabase-Pre auth RCE
  • Ivanti Sentry Authentication Bypass
  • GeoServer property (CVE-2024-36401)
  • UNAUTHENTICATED SERVER SIDE REQUEST FORGERY & CRLF INJECTION IN GEOSERVER WMS(CRLF)
  • JetBrains TeamCity (CVE-2023-42793)
  • JetBrains TeamCity(CVE-2024-23917)(SpringBoot)
  • SysAid On-Prem Software(CVE-2023-47246)
  • MCMSBypass()
  • Atlassian Confluence-Remote Code Execution(CVE-2023-22527)
  • JenkinsCVE-2024-23897

17.+

• velocity

• freemarker

• pebble

• thymeleaf

• JfinalEnjoy

• Beetl3.15.0(Rce)

• EL

  • EL

  • Java

  • elwaftrick

18.URITrick

• Tomcat URL(HttpServletRequestURL)
• Tomcaturl
• SpringBoot2.3.0%2e()
• Jetty(%uxxx)
• JFinalDenyAccessJsp

19.ASMJVM

• JAVA()
• What is a stack map frame
  • Java 1.7GOTO / JUMPSAMEAPPENDFULL
• JVMDUP

20.

• Hacking FernFlower

• JMX
  • JMX RMI
  • jmxrce
  • tomcat-jmxproxy-rce-exp(JMX with AccessLogValve)
• GadgetInspector
• CVE-2021-2471 JDBC-XXE
• spring-messaging
• CVE-2020-9484 Tomcat-RCE(:Tomcat)
• Java
• Servlet
• BypassSM
• Spring Boot FatJarGetshell
• TemplatesImpl
• resolveClass
• Java
• java - Memory DoS
• Rasp
• JEP 290
• Java Web Dump JDBC()
• Jar
• Java()
  • channel()
• OpenRasp
• Apache Unomi
• JEXL3
• JVMTIJAR()
• Maven
• RCE(OA)
• JDK-XalanXSLT
• Cloud
• ()
• jdk(toString)

Java

• Codegate2022(:filexpath)
• SUSCTF2022(:raspfastjsonxxe)
• D^3CTF2022(:ROMEMybatisOgnl)
• CTF2022(:HessianRomejava.security.SignedObject#getObjectUnixPrintServiceTabby)
• MRCTF2022(:KryoRomeBypass SerialKiller-)
• GoogleCTF2022(Log4j2BundleReDoS)
• UIUCTF2022-Spoink(PebbleBypassSpring)
• TetCTF2023&Liferay(CVE-2019-16891)(Pre-Auth RCE)

• Weblogic
• ideatomcat

Todolist

• serialVesionUID--
• Dubbo
• Agent(Java-Rebyond)
• Trick
• waf

• Y4tacker()
• su18
• landgrey

Ps:(0day)