Technical Tag
13 related articles.
0x01 Preface Some time ago I finally wrote Principles and Case Study of File Inclusion, which mentioned Thymeleaf SSTI. Yesterday Sanmeng shared a newly discovered Thymeleaf SSTI bypass CVE. Since my project code was still available, I analyzed it. 0x02 Thymeleaf SSTI Thymeleaf…
0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover…
About this book. I finished writing it last December. The seven months from revision to publication were a long and demanding journey. The book is well suited to beginners and expands both the breadth and depth of my Java Code Auditing for Beginners article series—which is also why that series had not been updated for so long. If you want to learn Java code auditing, consider picking up a copy. Purchase link: https://item.jd.…
JEP 290 0x01 What Is a JEP? JDK Enhancement Proposal, abbreviated JEP, is the process for proposing JDK enhancements. The index has reached JEP 415. This article focuses on JEP 290: what it is, what it does, and known bypass approaches. 0x02 What Is JEP 290? JEP 290 is described as Filter Incoming…
0x01 Preface This article is detailed; copy the demo and follow in a debugger. 0x02 Flow Analysis Serialization writes an object to an I/O stream. It usually begins by creating ObjectOutputStream and calling its write…
0x01 Preface The construction of the native JDK 7u21 gadget chain is a classic. After studying its structure and underlying ideas, I wrote this article as a set of notes. 0x02 Prerequisites The JDK 7u21 chain uses many fundamental Java concepts, principally Java reflection, dynamic class modification with Javassist, Java static class loading, Java dynamic proxies, and hash collisions. To make the article easier to follow, I will…
0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover…
0x01 What Is Reflection? Reflection is a Java feature absent from C/C++. It lets a running program inspect itself and operate on internal properties of classes and objects. Oracle explains: 'Reflection enables Java code to disc…'
0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover…
0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover…
0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover…
0x01 Prepared statements. JDBC provides a preparation mechanism for SQL statements in Java. Its major advantages are faster execution—especially when a database operation is repeated—and protection against most SQL injection attacks. The sample below shows a JDBC prepared statement. How exactly does this mechanism prevent SQL injection?…
Spring Study Notes: IoC. Preface. As I begin studying Java code auditing, I am first learning the ideas and programming patterns behind Spring. These notes record that process. IoC—Inversion of Control, also known as dependency injection—is an important object-oriented principle for reducing program coupling and is central to Spring…