Technical Tag

Java Serialization

2 related articles.

2021-06-30

Understanding the Native JDK 8u20 Deserialization Vulnerability Through a Case Study

0x01 Preface The native JDK 8u20 deserialization vulnerability is a classic and one of the most complex vulnerabilities I have analyzed. It uses substantial low-level knowledge and assumes familiarity with the deserialization process and serialized-data structure. This article reflects my own understanding; please point out any inaccuracies. 0x02 JDK 8u20 Vulnerability Principles JDK…

2021-06-10

Notes on the Object Serialization Stream Protocol

0. Preface This article mainly translates the Object Serialization Stream Protocol and summarizes the serialization format. 1. Overview The stream format has the following design goals: a compact structure for efficient reading; the ability to use the stream structure and format without detailed knowledge of the stream or invoking class code; and access and manipulation only through the stream…