Java-Deserialization-Cheat-Sheet - The cheat sheet about Java Deserialization vulnera

项目说明

Ja-Sheet

A cheat sheet for pentesters and researchers about deserialization in Java (J libraries.

Please, use #ja hash tag for tweets.

Table of content

Ja Serialization (binary)

- O
- Main talks & presentations & docs
- Payload generators
- Exploits
- Detect
- apps (without public sploits/need more info)
- Protection
- For Android

XMLEncoder (XML)

XStream (XML/JSON/)

Kryo (binary)

Hessian/Burlap (binary/XML)

Castor (XML)

json-io (JSON)

Jackson (JSON)

Fastjson (JSON)

Genson (JSON)

Flexjson (JSON)

Jodd (JSON)

Red5 IO AMF (AMF)

Apache Flex BlazeDS (AMF)

Flamingo AMF (AMF)

GraniteDS (AMF)

WebORB for Java (AMF)

SnakeYAML (YAML)

jYAML (YAML)

YamlBeans (YAML)

"Safe" deserialization

Ja Serialization (binary)

O

Ja Security FAQ

From Foxglo

Main talks & presentations & docs

##### Marshalling Pickles
by &

Video

Slides

Other stuff

##### Exploiting Deserialization in Java
by

Video

##### Serial Killer: Silently Pwning Your Ja
by &

Slides

White Paper

Bypass Gadget Collection

##### Deserialize My Shorts: Or How I Learned To Start Worrying and Hate Ja Deserialization
by &

Slides

##### Sur the Ja apocalypse
by &

Slides

Video

PoC for Scala, Grovy

##### Ja - The Forgotten Bug Class
by

Slides

##### Pwning Your Ja With Deserialization
by

Slides

White Paper

Tool for jms hacking

##### Defending against Ja
by

Slides

##### A Journey From JNDI/LDAP Manipulation To Remote Code Execution Dream Land
by and O. Mirosh

Slides

White Paper

##### Fixing the Ja mess
by

Slides+Source

##### Blind Ja
by deadcode.me

Part I - Commons Gadgets

Part II - exploitation rev 2

##### An O of Deserialization in the Ja Machine (JVM)
by

Slides

Examples

##### Automated Discovery of Deserialization Gadget Chains
by

Video

Slides

Tool

##### An Far Sides Of Ja Protocols
by @_tint0

Slides

Payload generators

##### ysoserial

ysoserial 0.6 payloads:

payload | author | dependencies | impact (if not RCE)
------|--------|------ |------
AspectJWeaver | |aspectjweaver:1.9.2, commons-collections:3.2.2
BeanShell1 |, |bsh:2.0b5
C3P0 | |c3p0:0.9.5.2, mchange-commons-java:0.2.11
Click1 | |click-nodeps:2.3.0, ja:3.1.0
Clojure | |clojure:1.8.0
CommonsBeanutils1 | |commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
CommonsCollections1 | |commons-collections:3.1
CommonsCollections2 | |commons-collections4:4.0
CommonsCollections3 | |commons-collections:3.1
CommonsCollections4 | |commons-collections4:4.0
CommonsCollections5 |, |commons-collections:3.1
CommonsCollections6 | |commons-collections:3.1
CommonsCollections7 |, , |commons-collections:3.1
FileUpload1 | |commons-fileupload:1.3.1, commons-io:2.4 | file uploading
Groovy1 | |groovy:2.3.9
Hibernate1 ||
Hibernate2 ||
JBossInterceptors1 | |ja:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, ja:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
JRMPClient ||
JRMPListener ||
JSON1 | |json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
Ja | |ja:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, ja:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
Jdk7u21 ||
Jython1 |, |jython-standalone:2.5.2
MozillaRhino1 | |js:1.7R2
MozillaRhino2 |@_tint0 |js:1.7R2
Myfaces1 ||
Myfaces2 ||
ROME | |rome:1.0
Spring1 | |spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
Spring2 | |spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
URLDNS || |jre only vuln detect
| |:7.7.14, :7.7.14
Wicket1 |-baines |wicket-util:6.23.0, slf4j-api:1.6.4

Plugins for Burp Suite (detection, ysoserial integration ):

Freddy

Ja

Ja Scanner

Burp-ysoserial

SuperSerial

SuperSerial-Active

Full shell (pipes, redirects and other stuff):

$@|sh – Or: Getting a shell en from Runtime.exec

Set String[] for Runtime.exec (patch ysoserial's payloads)

Shell Commands Con

How it works:

##### ysoserial fork with additional payloads

CommonsCollection8,9,10

RMIRegistryExploit2,3

RMIRefListener,RMIRefListener2

PayloadHTTPServer

Spring3

##### JRE8u20_RCE_Gadget

Pure JRE 8 RCE Deserialization gadget

##### ACEDcup

File uploading via:

Apache Commons FileUpload <= 1.3 (C) and Oracle JDK < 7u40

##### Uni billion-laughs DoS

Won't fix DoS Ja (JRE)

##### Uni Heap o DoS using Arrays and HashMaps

How it works:

Ja DoS - payloads

Won't fix DoS using default Ja (JRE)

##### DoS against Serialization Filtering (JEP-290)

C

##### Tool to search gadgets in source

Gadget Inspector

Article about Gadget Inspector

##### Additional tools to test RMI:

BaRMIe

Barmitza

RMIScout

attackRmi

Remote Method Guesser

##### Remote class detection:

GadgetProbe: Exploiting Deserialization to Brute-Force the Remote Classpath

GadgetProbe

Remote Ja enumeration with EnumJa

EnumJa

##### Library for creating Ja data

serial-builder

Exploits

no spec tool - You don't need a special tool (just Burp/ZAP + payload)

##### RMI

*Protocol*

*Default - 1099/tcp for rmiregistry*

partially patched in JRE with JEP290 (JDK 8u121, JDK 7u131, JDK 6u141)

Attacking Java RMI services after JEP 290

An Trinhs RMI Registry Bypass

RMIScout

ysoserial

Additional tools

##### JMX

*JMX on RMI*

+ C

partially patched in JRE with JEP290 (JDK 8u121, JDK 7u131, JDK 6u141)

Attacking RMI based JMX services (after JEP 290)

ysoserial

mjet

JexBoss

##### JMXMP

*Special JMX protocol*

The Curse of Old Ja

##### JNDI/LDAP

When we control an address for lookup of JNDI (context.lookup(address) and can ha from a server

Full info

JNDI remote code injection

Exploiting JNDI Injections in Java

##### JMS

Full info

JMET

##### JSF

if no encryption or good mac

no spec tool

JexBoss

##### vjdbc

JDBC via HTTP library

all are

Details

no spec tool

##### T3 of Oracle Weblogic

*Protocol*

*Default - 7001/tcp on localhost interface*

C

Blacklist bypass - C

Blacklist bypass - C PoC

Blacklist bypass - C

Blacklist bypass - c

Blacklist bypass - C

Blacklist bypass - C

C

C

C

C

C

C

C

C

C

C

C

SSRF JDBC

C

loubia (tested on 11g and 12c, supports t3s)

Ja (doesn't work for all Weblogic )

WLT3Serial

C sploit

##### IIOP of Oracle Weblogic

*Protocol*

*Default - 7001/tcp on localhost interface*

C

Details

C sploit

##### Oracle Weblogic (1)

auth required

How it works

C

##### Oracle Weblogic (2)

auth required

C

Exploit

##### Oracle Access Manager (1)

C

##### Oracle ADF Faces

C–21445

/appcontext/afr/test/remote/payload/

no spec tool

##### IBM Websphere (1)

*wsadmin*

*Default port - 8880/tcp*

C

Ja

serialator

CoalfireLabs/jaits

##### IBM Websphere (2)

When using custom form authentication

WASPostParam cookie

Full info

no spec tool

##### IBM Websphere (3)

IBM WAS DMGR

special port

C

ibm10883628

Exploit

Metasploit

##### IIOP of IBM Websphere

*Protocol*

2809, 9100, 9402, 9403

C

C

Abusing Ja Protocols in IBM WebSphere

Vuln Details

##### Red Hat JBoss (1)

*

*Default port - 8080/tcp*

C

Ja

serialator

JexBoss

##### Red Hat JBoss 6.X

*

*Default port - 8080/tcp*

C

JBoss 6.X and EAP 5.X

Details

no spec tool

##### Red Hat JBoss 4.x

*

<= 4.x

C

no spec tool

##### Jenkins (1)

*Jenkins CLI*

*Default port - High number/tcp*

C

C

Ja

JexBoss

##### Jenkins (2)

patch "bypass" for Jenkins

C

Details of exploit

ysoserial

##### Jenkins (s)

*Jenkins CLI LDAP*

*Default port - High number/tcp

<= 2.32

<= 2.19.3 (LTS)

C

##### CloudBees Jenkins

<= 2.32.1

C

Details

Sploit

##### JetBrains TeamCity

RMI

ysoserial

##### Restlet

*<= 2.1.2*

*When Rest API accepts serialized objects (uses ObjectRepresentation)*

no spec tool

##### RESTEasy

*When Rest API accepts serialized objects (uses ({"\*/\*"}) or "application/\*" )

Details and examples

no spec tool

##### OpenNMS (1)

RMI

ysoserial

##### OpenNMS (2)

C/NMS-12673

JMS

JMET

##### Progress OpenEdge RDBMS

all

RMI

ysoserial

##### Commvault Edge Server

C

Serialized object in cookie

no spec tool

##### Symantec Endpoint Protection Manager

*/servlet/ConsoleServlet?ActionType=SendStatPing*

C

serialator

##### Oracle MySQL Enterprise Monitor

*]:18443/v3/dataflow/0/0*

C

no spec tool

serialator

##### PowerFolder Business Enterprise Suite

custom(?) protocol (1337/tcp)

MSA-2016-01

powerfolder-exploit-poc

##### Solarwinds Manager

<= 6.3.1

RMI

C

ysoserial

##### Cisco Prime Infrastructure

*]/xmp_data_handler_service/xmpDataOperationRequestServlet*

<= 2.2.3 Update 4

<= 3.0.2

C

CoalfireLabs/jaits

##### Cisco ACS

<= 5.8.0.32.2

RMI (2020 tcp)

CSCux34781

ysoserial

##### Cisco Unity Express

RMI (port 1099 tcp)

< 9.0.6

C

ysoserial

##### Cisco Unified CVP

RMI (2098 and 2099)

Details

ysoserial

##### NASDAQ BWISE

RMI (port 81 tcp)

Details

C

ysoserial

##### NICE ENGAGE PLATFORM

JMX (port 6338 tcp)

Details

C

##### Apache Cassandra

JMX (port 7199 tcp)

Details

C

##### Cloudera Zookeeper

JMX (port 9010 tcp)

Details

##### Apache Olingo

< 4.7.0

C

Details and examples

no spec tool

##### Apache Dubbo

C

Details and examples

no spec tool

##### Apache XML-RPC

all , no fix (the project is not supported)

POST XML request with <ex:serializable> element

Details and examples

no spec tool

##### Apache Archiva

because it uses Apache XML-RPC

C

Details and examples

no spec tool

##### SAP NetWeaver

*]/de/metadatauploader*

C

PoC

##### SAP Hybris

*//*

C

no spec tool

##### Sun Java Web Console

admin panel for Solaris

< v3.1.

old DoS sploit

no spec tool

##### Apache MyFaces Trinidad

1.0.0 <= < 1.0.13

1.2.1 <= < 1.2.14

2.0.0 <= < 2.0.1

2.1.0 <= < 2.1.1

it does not check MAC

C

no spec tool

##### JBoss Richfaces

of exploitation C

When EL Injection meets Ja

##### Apache Tomcat JMX

JMX

Patch bypass

C

JexBoss

##### OpenText Documentum D2

* 4.x*

C

exploit

##### Liferay

*/api/spring*

*/api/liferay*

<= 7.0-ga3

if IP check works incorrectly

Details

no spec tool

##### ScrumWorks Pro

*/UFC*

<= 6.7.0

Details

PoC

##### ManageEngine Applications Manager

RMI

C

ysoserial

##### ManageEngine OpManager

< 12.5.329

Details with exploit C/C

##### ManageEngine Desktop Central

< 10.0.474

C

MSF exploit

##### Apache Shiro

SHIRO-550

encrypted cookie (with the hardcoded key)

Exploitation (in Chinese)

##### HP IMC (Intelligent Management Center)

WebDMDebugServlet

<= 7.3 E0504P2

C

Metasploit module

##### HP IMC (Intelligent Management Center)

RMI

<= 7.3 E0504P2

C

ysoserial

##### Apache Brooklyn

Non default config

JMXMP

##### Elassandra

Non default config

JMXMP

##### Micro Focus

C

analyzis

Affected products:

Operations Bridge Manager : 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.6x and 10.1x and older

Application Performance Management : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 \

Data Center Automation 2019.11

Operations Bridge (containerized) : 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11

Uni CMDB : 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30

Hybrid Cloud Management 2020.05

Service Management Automation 2020.5 and 2020.02

Metasploit Exploit

##### IBM Qradar (1)

C

Exploitation

##### IBM Qradar (2)

*/console/remoteJa*

C

Exploit

##### IBM InfoSphere JReport

RMI

port 58611

<=8.5.0.0 (all)

Exploitation details

##### Apache Kafka

connect-api

analyzis

##### Zoho ManageEngine ADSelfService Plus

C

Exloitation

##### Apache ActiveMQ - Client lib

JMS

JMET

##### Redhat/Apache HornetQ - Client lib

JMS

JMET

##### Oracle OpenMQ - Client lib

JMS

JMET

##### IBM WebSphereMQ - Client lib

JMS

JMET

##### Oracle Weblogic - Client lib

JMS

JMET

##### Pivotal RabbitMQ - Client lib

JMS

JMET

##### IBM MessageSight - Client lib

JMS

JMET

##### IIT Software SwiftMQ - Client lib

JMS

JMET

##### Apache ActiveMQ Artemis - Client lib

JMS

JMET

##### Apache QPID JMS - Client lib

JMS

JMET

##### Apache QPID - Client lib

JMS

JMET

##### Amazon SQS Ja - Client lib

JMS

JMET

##### Axis/Axis2 SOAPMonitor

All (this was deemed by design by project maintainer)

Binary

Default port : 5001

Info :

> java -jar ysoserial-*-all.jar CommonsCollections1 'COMMAND_HERE' | nc TARGET_SERVER 5001

ysoserial

##### Apache Synapse

<= 3.0.1

RMI

Exploit

ysoserial

##### Apache Jmeter

<= 3.0.1

RMI

When using Distributed Test only

Exploit

ysoserial

##### Jolokia

<= 1.4.0

JNDI injection

/jolokia/

Exploit

##### RichFaces

all

Poor RichFaces

When EL Injection meets Ja

##### Apache James

< 3.0.1

Analysis of C

ysoserial

##### Oracle DB

<= Oracle 12C

C - Oracle Pri Escalation

##### Zimbra Collaboration

< 8.7.0

C

<= 8.8.11

A Saga of Code Executions on Zimbra

##### Adobe ColdFusion (1)

<= 2016 Update 4

<= 11 update 12

C

C

##### Adobe ColdFusion (2)

RMI

<= 2016 Update 5

<= 11 update 13

Another ColdFusion RCE – C

C

##### Adobe ColdFusion (3) / JNBridge

custom protocol in JNBridge

port 6093 or 6095

<= 2016 Update ?

<= 2018 Update ?

APSB19-17

C: ColdFusion Code Execution Through JNBridge

##### Apache SOLR (1)

SOLR-8262

5.1 <= <=5.4

/stream handler uses Ja for RPC

##### Apache SOLR (2)

SOLR-13301

C

: 5.0.0 to 5.5.5

: 6.0.0 to 6.6.5

Attack via jmx.ser

Exploit

##### Adobe Experience Manager AEM

5.5 - 6.1 (?)

/lib/dam/cloud/proxy.json parameter file

ExternalJobPostServlet

##### MySQL Connector/J

< 5.1.41

when "autoDeserialize" is set on

C

##### Pitney Bowes Spectrum

RMI

Java RMI Ser Default Configuration

##### SmartBear ReadyAPI

RMI

SYSS-2019-039

##### NEC ESMPRO Manager

RMI

C

ZDI-20-684

##### Apache OFBiz

RMI

c

Exploit

##### NetMotion Mobility

< 11.73

< 12.02

NetMotion Mobility Ser Deserialization of Untrusted Data Lead to RCE

C

ysoserial
Metasploit Exploit: exploit/windows/http/netmotion_mobility_m

##### Bonita

Bonita ser

/bonita/ser/

ysoserial

##### Neo4j

<= 3.4.18 (with the shell ser)

RMI

Exploit for C

##### Bitbucket Data Center

port 5701 (Hazelcast)

similar to C

Exploit for C

##### Jira Data Center / Jira Service Management Data Center

RMI of Ehcache

C

##### Nomulus

patched

Details of exloitation

Detect

##### Code review

*ObjectInputStream.readObject*

*ObjectInputStream.readUnshared*

Tool: Find Security Bugs

Tool: Serianalyzer

##### Traffic

*Magic bytes 'ac ed 00 05' bytes*

*'rO0' for Base64*

*'application/x-ja' for Content-Type header*

##### Network

Nmap >=7.10 has more ja probes

use nmap --all- to find JMX/RMI on non-standart ports

##### Burp plugins

Ja

Ja Scanner

Burp-ysoserial

SuperSerial

SuperSerial-Active

Freddy

apps (without public sploits/need more info)

##### Spring Service In (HTTP, JMS, RMI...)

Details

##### SAP P4

info from slides

##### Apache ActiveMQ (2)

*C*

*<= 5.12.1*

*Explanation of the vuln*

C

##### Atlassian Bamboo (1)

C

*2.2 <= < 5.8.5*

*5.9.0 <= < 5.9.7*

##### Atlassian Bamboo (2)

*C*

*2.3.1 <= < 5.9.9*

Bamboo JMS port (port 54663 by default)

##### Atlassian Jira

only Jira with a Data Center license

RMI (port 40001 by default)

*JRA-46203*

##### Akka

* < 2.4.17*

"an ActorSystem exposed via Akka Remote over TCP"

Official description

##### Spring AMPQ

C

*1.0.0 <= < 1.5.5*

##### Apache Tika

C

*1.6 <= < 1.14*

Apache Tika’s MATLAB Parser

##### Apache HBase

HBASE-14799

##### Apache Camel

C

##### Apache Dubbo

C

<=2.7.7

##### Apache Spark

SPARK-20922: Unsafe deserialization in Spark LauncherConnection

##### Apache Spark

SPARK-11652: Remote code execution with In

##### Apache Log4j (1)

as server

C

##### Apache Log4j (2)

*<= 1.2.17*

C

##### Apache Geode

C

C

Details

##### Apache Ignite

C

C

Details

##### Infinispan

C

Details

##### Hazelcast

C

Details

##### Gradle (gui)

custom(?) protocol(60024/tcp)

article

##### Oracle Hyperion

from slides

##### Oracle Application Testing Suite

C

##### Red Hat JBoss BPM Suite

RHSA-2016-0539

C

##### Red Hat Wildfly

C

##### Operations

6.0 <= < 6.4.0

REST API

C

##### / ()

C

JMX

##### Cisco ()

List of products

C

##### Cisco Security Manager

C

##### Lexmark Mark Enterprise

C

##### McAfee ePolicy Orchestrator

C

##### HP IMC PLAT

7.3 E0506P09 and earlier

several C

##### HP iMC

C

##### HP Operations Orchestration

C

##### HP Asset Manager

C

##### HP Service Manager

C

##### HP Operations Manager

C

##### HP Release Control

C

##### HP Continuous Delivery Automation

C

##### HP P9000, XP7 Command View Ad Edition (CVAE) Suite

C

##### HP Network Automation

C

##### Adobe Experience Manager

C

##### Unify OpenScape ()

C (CVE ID changed?)

RMI (30xx/tcp)

C (CVE ID changed?)

js-soc protocol (4711/tcp)

Details

##### Apache OFBiz (1)

C

##### Apache OFBiz (2)

C

##### Apache Tomcat (1)

requires local access

C

Article

##### Apache Tomcat (2)

many requirements

Apache Tomcat Remote Code Execution persistence

C

##### Apache TomEE

C

##### IBM Congnos BI

C

##### IBM Maximo Asset Management

C

##### Novell NetIQ Sentinel

C

##### ForgeRock OpenAM

*9-9.5.5, 10.0.0-10.0.2, 10.1.0-Xpress, 11.0.0-11.0.3 and 12.0.0*

201505-01

##### F5 ()

sol30518307

##### Hitachi ()

HS16-010

0328_acc

##### NetApp ()

C (CVE ID changed?)

##### Citrix XenMobile Server

port 45000

when Clustering is enabled

Won't Fix (?)

10.7 and 10.8

Citrix ad

C

##### IBM WebSphere (1)

SOAP connector

<= 9.0.0.9

<= 8.5.5.14

<= 8.0.0.15

<= 7.0.0.45

C

##### IBM WebSphere (2)

C

##### IBM WebSphere (3)

TCP port 11006

C

Vuln details

##### IBM WebSphere (4)

SOAP connector

C

Vuln details

##### IBM WebSphere (5)

C

##### IBM WebSphere (6)

C

##### IBM WebSphere (7)

C

##### Code42 CrashPlan

*TCP port 4282*

RMI (?)

5.4.x

C

Details

##### Apache OpenJPA

C

##### Dell EMC and Reporting

C

##### Taoensso Nippy

<2.14.2

C

##### CAS

v4.1.x

v4.2.x

CAS Disclosure from Apereo

##### SolarWinds Network Performance Monitor

C–31474

Video

##### Apache Batchee
##### Apache JCS
##### Apache OpenWebBeans

Protection

Look-ahead Ja

NotSoSerial

SerialKiller

eam

Name Space Layout Randomization

Some protection bypasses

Tool: Serial Whitelist Application Trainer

JEP 290: Filter Incoming Serialization Data in JDK 6u141, 7u131, 8u121

- A First Look Into Java's New Serialization Filtering

AtomicSerial

For Android

#### Main talks & presentations & examples

One Class to Rule Them All: 0-Day Deserialization in Android

Android Serialization Re

A brief history of Android deserialization

Exploiting Android trough an Intent with Reflection

#### Tools

Android Ja Tester

XMLEncoder (XML)

How it works:

Ja Security

Detect

##### Code review

ja.XMLDecoder

readObject

##### Burp plugins

Freddy

Exploits

##### Oracle Weblogic

<= 10.3.6.0.0

<= 12.1.3.0.0

<= 12.2.1.2.0

<= 12.2.1.1.0

*

C

C

Details

C Details

Exploit

##### Oracle RDBMS

pri

Oracle Pri Escalation

XStream (XML/JSON/)

How it works:

Ja Security

Payload generators

C

C - SSRF

C

C

Exploits

##### Apache Struts (S2-052)

<= 2.3.34

<= 2.5.13

REST plugin

C

Exploit

Detect

##### Code review

com.thoughtworks.xstream.XStream

xs.fromXML(data)

##### Burp plugins

Freddy

apps (without public sploits/need more info):

##### Atlassian Bamboo

C

##### Jenkins

C

Kryo (binary)

How it works:

Ja Security

Payload generators

Detect

##### Code review

com.esotericsoftware.kryo.io.Input

SomeClass object = (SomeClass)kryo.readClassAndObject(input);

SomeClass someObject = kryo.readObjectOrNull(input, SomeClass.class);

SomeClass someObject = kryo.readObject(input, SomeClass.class);

##### Burp plugins

Freddy

Hessian/Burlap (binary/XML)

How it works:

Ja Security

Castor and Hessian ja

Recurrence and Analysis of Hessian Deserialization RCE

Payload generators

Detect

##### Code review

com.caucho.hessian.io

AbstractHessianInput

com.caucho.burlap.io.BurlapInput;

com.caucho.burlap.io.BurlapOutput;

BurlapInput in = new BurlapInput(is);

Person2 p1 = (Person2) in.readObject();

##### Burp plugins

Freddy

apps (without public sploits/need more info):

##### Apache Camel

C

##### MobileIron MDM

C

Metasploit Exploit

##### Apache Dubbo

Details and examples

Castor (XML)

How it works:

Ja Security

Castor and Hessian ja

Payload generators

Detect

##### Code review

org.codehaus.castor

org.exolab.castor.xml.Unmarshaller

org.springframework.oxm.Unmarshaller

Unmarshaller.unmarshal(Person.class, reader)

unmarshaller = context.createUnmarshaller();

unmarshaller.unmarshal(new StringReader(data));

##### Burp plugins

Freddy

apps (without public sploits/need more info):

##### OpenNMS

NMS-9100

##### Apache Camel

C

json-io (JSON)

How it works:

Ja Security

Exploitation examples:

Experiments with JSON-IO, Serialization, Mass Assignment, and General Ja Wizardry

JSON Deserialization Memory Corruption on Android

Payload generators

Detect

##### Code review

com.cedarsoftware.util.io.JsonReader

JsonReader.jsonToJava

##### Burp plugins

Freddy

Jackson (JSON)

* in specific configuration*

How it works:

Ja Security

On Jackson CVEs: Don’t Panic — Here is what you need to know

Jackson Deserialization

The End of the Blacklist

Payload generators / gadget chains

blacklist bypass - C

blacklist bypass - C

C

Jackson gadgets - Anatomy of a

JNDI Injection using Getter Based Deserialization Gadgets

blacklist bypass - C

blacklist bypass - C

Detect

##### Code review

com.fasterxml.jackson.databind.ObjectMapper

ObjectMapper mapper = new ObjectMapper();

objectMapper.enableDefaultTyping();

(use=JsonTypeInfo.Id.CLASS, include=JsonTypeInfo.As.PROPERTY, property="")

public Object message;

mapper.readValue(data, Object.class);

##### Burp plugins

Freddy

Exploits

##### FasterXML

C

##### Liferay

C

apps (without public sploits/need more info):

##### Apache Camel

C

Fastjson (JSON)

How it works:

Official ad

Fastjson process analysis and RCE analysis

Fastjson Deserialization History

Hao Xing Zekai Wu - How I use a JSON Deserialization 0day to Steal Your Money On The Blockchain.pdf

Detect

##### Code review

com.alibaba.fastjson.JSON

JSON.parseObject

##### Burp plugins

Freddy

Payload generators

fastjson 1.2.24 <=

fastjson 1.2.47 <=

fastjson 1.2.66 <=

blacklisted gadgets

Fastjson: exceptional deserialization

Hao Xing Zekai Wu - How I use a JSON Deserialization 0day to Steal Your Money On The Blockchain.pdf

Genson (JSON)

How it works:

Friday the 13th JSON Attacks

Detect

##### Code review

com.owlike.genson.Genson

useRuntimeType

genson.deserialize

##### Burp plugins

Freddy

Flexjson (JSON)

How it works:

Friday the 13th JSON Attacks

Payload generators / gadget chains

PoC

Detect

##### Code review

import flexjson.JSONDeserializer

JSONDeserializer jsonDeserializer = new JSONDeserializer()

jsonDeserializer.deserialize(jsonString);

Exploits

##### Liferay

Liferay Portal JSON Web Service RCE

CST-7111

Jodd (JSON)

* in a non-default configuration when setClassMetadataName() is set*

issues/628

Payload generators / gadget chains

PoC

Detect

##### Code review

com.fasterxml.jackson.databind.ObjectMapper

JsonParser jsonParser = new JsonParser()

jsonParser.setClassMetadataName("class").parse(jsonString, ClassName.class);

Red5 IO AMF (AMF)

How it works:

Ja Security

Payload generators

Detect

##### Code review

org.red5.io

Deserializer.deserialize(i, Object.class);

##### Burp plugins

Freddy

apps (without public sploits/need more info):

##### Apache OpenMeetings

C

Apache Flex BlazeDS (AMF)

How it works:

AMF – Another Malicious Format

Ja Security

Payload generators

Detect

##### Code review

##### Burp plugins

Freddy

apps:

##### Oracle Business Intelligence

*BIRemotingServlet*

no auth

C

Details on the Oracle WebLogic Being Exploited in the Wild

C–2950 — Turning AMF Deserialize bug to Ja bug

##### Adobe ColdFusion

C

*<= 2016 Update 3*

*<= 11 update 11*

*<= 10 Update 22*

Exploiting Adobe ColdFusion before C

PoC

##### Draytek

*/ACSSer/amf*

at least 2.2.1

based on C

PoC

##### Apache BlazeDS

C

#####

based on C

##### HP Systems Insight Manager

*/simsearch/messagebroker/amfsecure*

7.6.x

C

Metasploit Exploit

##### TIBCO Data

< 8.3

*/monitor/messagebroker/amf*

Details

Flamingo AMF (AMF)

How it works:

AMF – Another Malicious Format

Detect

##### Burp plugins

Freddy

GraniteDS (AMF)

How it works:

AMF – Another Malicious Format

Detect

##### Burp plugins

Freddy

WebORB for Java (AMF)

How it works:

AMF – Another Malicious Format

Detect

##### Burp plugins

Freddy

SnakeYAML (YAML)

How it works:

Ja Security

Payload generators

Payload Generator for the SnakeYAML deserialization gadget

Detect

##### Code review

org.yaml.snakeyaml.Yaml

yaml.load

##### Burp plugins

Freddy

apps (without public sploits/need more info):

##### Resteasy

C

##### Apache Camel

C

##### Apache Brooklyn

C

##### Apache ShardingSphere

C

jYAML (YAML)

How it works:

Ja Security

Payload generators

Detect

org.ho.yaml.Yaml

Yaml.loadType(data, Object.class);

##### Burp plugins

Freddy

YamlBeans (YAML)

How it works:

Ja Security

Payload generators

Detect

com.esotericsoftware.yamlbeans

YamlReader r = new YamlReader(data, yc);

##### Burp plugins

Freddy

"Safe" deserialization

Some serialization libs are safe (or almost safe)

However, it's not a recommendation, but just a list of other libs that has been researched by someone:

JAXB

XmlBeans

Jibx

Protobuf

GSON

GWT-RPC

项目信息

开发语言：未知

Star 数：3185

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕The cheat sheet about Java Deserialization vulnerabilities展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。