How to understand JAVA deserialization

This article mainly explains "JAVA deserialization how to understand", the article explains the content is simple and clear, easy to learn and understand, the following please follow the editor's ideas slowly in depth, together to study and learn "JAVA deserialization how to understand" it!

Three main parts of deserialization

Deserialization RCE is divided into three parts, carrier, execution function, echo. Carriers include protocols, encryption and decryption algorithms, and so on. The execution function is the deserialization function after passing the carrier. Echo is divided into explicit echo and implicit echo, explicit echo examples such as Webshell, HTTP response body, picture steganography, implicit echo examples such as RMI, URLDNS and so on.

How to learn

After understanding the basic composition, find the relevant parts in order, and then put them together.

Carrier:

Vectors are ubiquitous in some large JAVA projects, such as a pile of Apache Software Foundation.

Execute the function:

In the function execution phase, anti-sequences generally use ObjectInputStream, of course, if you see different names, it may be encapsulated and inherited.

FileInputStream fis = new FileInputStream ("object"); ObjectInputStream ois = new ObjectInputStream (fis)

Show Echo:

1. File writing 2, HTTP response body3, delay 4, HTTP banner5, picture steganography.

Implicit echo:

1 、 RMI2 、 URLDNS3 、 LADP4 、 JNDI... Thank you for reading, the above is the content of "how to understand JAVA deserialization". After the study of this article, I believe you have a deeper understanding of how to understand JAVA deserialization, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!