SerialKillerBypassGadgetCollection

SerialKiller: 绕过 Gadget 集合 描述 一系列可用于 JVM 反序列化 Gadget 链的绕过 Gadget，用于绕过“Look-Ahead ObjectInputStreams”防御性反序列化。 作为 RSA 2016 演讲“SerialKiller: Silently Pwning Your Java Endpoints”的一部分发布，演讲者为 Alvaro Muñoz @pwntester 和 Christian Schneider @cschneider4711。 有关绕过 gadget 技术的详细信息，请参见以下资源： “论文” “幻灯片” “OWASP...

Fix weblogic JAVA deserialization vulnerability of a variety of methods-vulnerability warning-the black bar safety net

The current oracle is also not in the publicly released weblogic JAVA deserialization vulnerability official patch currently see the repair method is nothing more than two: Use SerialKiller replace the sequence of operation of the ObjectInputStream class; In does not affect the business case, the...