5.3.13. Reference Links

5.3.13.1. Official Documentation

• ognl

• Java SE Security Guide

• Java RMI Release Notes for JDK 6

• Java Release Notes for JDK 7

5.3.13.2. Mechanism Description

• Deep understanding of Java class loading

5.3.13.3. Deserialization

5.3.13.3.1. Standards

• Java Serialization [Draft 1]

• Java 14 Object Serialization Specification

5.3.13.3.2. Utilities and techniques

• Marshalling Pickles how deserializing objects can ruin your day

• AppSecCali 2015: Marshalling Pickles

• More serialization hacks with AnnotationInvocationHandler

• Pure JRE 8 RCE Deserialization gadget

• Breaking Defensive Serialization

• Java deserialization vulnerability from entry to in-depth

• General exploit analysis of Java deserialization vulnerability

• JRE8u20 Deserialization Vulnerability Analysis

• Analysis of Java serialization and deserialization

• In-depth Analysis of Commons Collections Java Deserialization Vulnerability

• FAR SIDES OF JAVA REMOTE PROTOCOLS

• New PoC idea and specific implementation of JDK8u20 deserialization vulnerability

• Pwn a CTF Platform with Java JRMP Gadget

• Talking about JEP 290

5.3.13.3.3. Framework

• A Ramble on WebLogic Deserialization Vulnerabilities

• Exploitation and Defense of Deserialization Vulnerabilities from WebLogic

• The curse of JSON deserialization

• Shiro Component Vulnerability and Attack Chain Analysis

• Application Security With Apache Shiro

• Shiro Security Framework [Quick Start]

• Shiro combat (4) - filter mechanism

5.3.13.4. Sandbox

• Java Sandbox Escape

5.3.13.5. Framework

• Struts

• Struts Examples

• Eclipse Jetty

• SpringBootVulExploit SpringBoot related vulnerability learning materials, collection of utilization methods and skills, black box security assessment checklist

5.3.13.5.1. Framework utilization techniques

• Exploration of Spring Boot Fat Jar Write File Vulnerability to Stable RCE

5.3.13.6. RMI

• Difference between Java RMI and RPC

• Remote Method Invocation (RMI)

• RMI, JNDI, LADP, JRMP, JMX, JMS in Java

• Oracle: Developing T3 Clients

5.3.13.7. JNDI

• Overview of JNDI

• About JNDI injection

• A Journey From JNDI LDAP Manipulation To RCE

• How to bypass the limitation of high version JDK for JNDI injection

5.3.13.8. WebShell

• Various poses jsp webshell

5.3.13.9. Other vulnerabilities

• JAVA common XXE vulnerability writing and defense