Research Category
Security Research
Using representative Black Hat talks from 2002–2026 as a thread, this piece revisits how Java security research moved from the JVM sandbox and client-side exploitation to deserialization, JNDI, middleware, parsing differentials and runtime defense.
A deep analysis of React2Shell (CVE-2025-55182): its root cause in the React Server Components Flight Reply deserializer, prototype-chain path traversal, the RCE gadget chain, and the patch.
Dynamic SQL is one of MyBatis's most powerful features. Constructing SQL manually is painful: spaces must be preserved and the trailing comma after the final column must be removed. Dynamic SQL eliminates that work. MyBatis is generally configured in one of two ways: XML files or annotations…
First published on Tiaotiaotang: http://tttang.com/archive/1532/ This blog is a backup. 0x01 Preface If asked to assess a CMS, where would you begin? Perhaps with the familiar body of code-auditing knowledge. But if asked to assess the Spring Framework itself, where would you begin? More broadly…
0x01 Preface On Tuesday, March 1, Spring published its Spring Cloud Gateway CVE report. CVE-2022-22947 was rated Critical. Analyses appeared Wednesday and Thursday, but work and thesis writing delayed my review. I reproduced and analyzed it over the weekend…
An article written last year but never published, now shared as both WeChat content and personal notes. Preface Since Fastjson 1.2.24's deserialization vulnerability was disclosed on March 15, 2017, it has been a major research target. Even checkAutoType did not fully stop new vulnerabilities. This article examines one through Xuanwu Lab's Black Hat talk…
0x01 Preface While following up on Log4j 2, I found several interesting details and recorded them here. 0x02 Is Log4j Never Vulnerable to JNDI Injection? First, a question: is Log4j never vulnerable to JNDI injection? No. I found an interesting exchange in a Log4j 2 pull request. Someone argued that Log4j is vulnerable…
0x01 Preface. December 9, 2021 became a sleepless night when Apache Log4j was found vulnerable to a simple, high-impact RCE. Countless components depend on Log4j2, apart from the risks in applications themselves. A Maven Repository search for projects using log4j-core 2.14…
0x01 Preface Some time ago I finally wrote Principles and Case Study of File Inclusion, which mentioned Thymeleaf SSTI. Yesterday Sanmeng shared a newly discovered Thymeleaf SSTI bypass CVE. Since my project code was still available, I analyzed it. 0x02 Thymeleaf SSTI Thymeleaf…
0x01 Preface The native JDK 8u20 deserialization vulnerability is a classic and one of the most complex vulnerabilities I have analyzed. It uses substantial low-level knowledge and assumes familiarity with the deserialization process and serialized-data structure. This article reflects my own understanding; please point out any inaccuracies. 0x02 JDK 8u20 Vulnerability Principles JDK…
JEP 290 0x01 What Is a JEP? JDK Enhancement Proposal, abbreviated JEP, is the process for proposing JDK enhancements. The index has reached JEP 415. This article focuses on JEP 290: what it is, what it does, and known bypass approaches. 0x02 What Is JEP 290? JEP 290 is described as Filter Incoming…
0x01 Preface As with the previous article, copy the demo and follow this analysis in a debugger. 0x02 Flow Analysis In Analysis of the Serialization Process, I noted that serialization writes an object to an I/O stream. It usually begins by creating an ObjectOutputStream…
Why did I start this official account? Traditional blogs no longer fully meet the needs of mobile readers. People increasingly prefer to use spare moments to read on their phones, which gave me the idea of creating a mobile platform. Blogging has been a habit of mine for nearly ten years, although my earlier writing appeared under another handle. When I was learning, I was deeply grateful to the people who willingly shared their knowledge, so once I became able to share what I had learned, I did not want to hold back…
0x01 Preface This article is detailed; copy the demo and follow in a debugger. 0x02 Flow Analysis Serialization writes an object to an I/O stream. It usually begins by creating ObjectOutputStream and calling its write…
0x01 Preface The construction of the native JDK 7u21 gadget chain is a classic. After studying its structure and underlying ideas, I wrote this article as a set of notes. 0x02 Prerequisites The JDK 7u21 chain uses many fundamental Java concepts, principally Java reflection, dynamic class modification with Javassist, Java static class loading, Java dynamic proxies, and hash collisions. To make the article easier to follow, I will…
0x01 Preface During a recent Dianfeng Geek CTF, I encountered a web challenge hinting at register_argc_argv but could not solve it. I later asked yzddmr6 and searched Chinese security research, finding little. This PHP setting seemed worth documenting. My practical experience is limited, so additions are welcome…
0x01 Preface. I recently read P's discussion of delimiter security and a Django security advisory, so I studied delimiter-related vulnerabilities. 0x02 Delimiters. A delimiter marks a boundary. If // is the delimiter, //panda// tells the computer to start at the first //, read panda, and stop at the next…
[1]: https://p4.ssl.qhimg.com/t014181cde9da013819.png
0x01 Description. CVE-2019-18622 affects phpMyAdmin before 4.9.2. A crafted database or table name can trigger SQL injection through the Designer feature. Official information: PMASA-2019-5, published 2019-10-28…
0x01 Preface Industrial-control security has grown increasingly popular in recent years, and many friends have asked how to learn it. I am still learning myself, so I cannot claim to know the single correct or fastest path. I can only share methods and experience from my own perspective. At the grandest level, learning industrial-control security contributes to national security; at the practical level, it is a way to make a living. The important thing is to choose the right prescription. What does that mean? It means…
0x01 Prepared statements. JDBC provides a preparation mechanism for SQL statements in Java. Its major advantages are faster execution—especially when a database operation is repeated—and protection against most SQL injection attacks. The sample below shows a JDBC prepared statement. How exactly does this mechanism prevent SQL injection?…
Understanding PHP Session Deserialization Vulnerabilities 0x01 Preface A recent Dianfeng Geek CTF included a session-deserialization challenge. I used it to organize PHP session deserialization's history and mechanics. 0x02 What Is a PHP Session? Before discussing PHP sessions, first understand sessions themselves…
First published on Xianzhi: https://xz.aliyun.com/t/6603 0x01 S7COMM S7COMM stands for S7 Communication. It is Siemens' proprietary protocol for programming and data exchange between S7-300/400 PLCs. S7 is carried over TPKT and ISO-COTP; this article focuses on S7Comm…
0x01 Background. I have been studying PHP Security Calendar 2017; this is Day 2, Twig: Can you spot the vulnerability? The challenge tests XSS. Most XSS occurs at output sinks such as echo $var when input is controllable and not adequately filtered…
0x01 Background. Day 1, Wish List: Can you spot the vulnerability? The key lies in in_array(). Its definition is in_array(search, array, type)…
Analysis. Before examining the vulnerability, review the background. 401 phishing, also called basic-authentication phishing, relies on the fact that most web servers allow anonymous access. Users normally retrieve public website content without entering authentication credentials. Nginx and Apache…
I. CVE-2017-9603. WordPress Plugin WP Jobs -1, 'orderby' => 'postdate', 'order' => 'DESC', 'posttype' => 'job', 'poststatus' => 'publish', 'suppressfilters' => true); $j…