java-deserialization-methodology

Java Deserialization Vulnerability Methodology

Java deserialization is one of the most dangerous vulnerability classes in the Java ecosystem—once successful, it usually leads directly to RCE.

⛔ In-Depth References (Must Read)

• Need the ysoserial gadget chain priority table, URLDNS detection, payload construction → references/ysoserial-gadgets.md
• Need JNDI injection, Fastjson version payloads, Shiro/WebLogic/JBoss/Jenkins specifics → references/jndi-fastjson.md

---

Phase 1: Identify Java Deserialization Entry Points

1.1 Native Java Serialized Data (Magic Bytes)

• Binary:\xac\xed\x00\x05（hex: aced0005）
• After Base64 encoding: starts with rO0AB Beginning
• After Gzip compression and then Base64: starts with H4sIAAAA Beginning

Check locations：Cookie（rememberMe/VIEWSTATE), POST Body, custom Header, WebSocket, RMI/T3/IIOP protocol ports

1.2 JSON Deserialization (Fastjson/Jackson)

• Fastjson: JSON contains the @type field → references/jndi-fastjson.md
• Jackson: DefaultTyping is enabled → JSON contains a class name array ["com.xxx.Class", {...}]
• Identification: send malformed JSON and observe the library name in the error stack

1.3 Specific Middleware Ports

Port	Service	Vulnerability Direction
7001/7002	WebLogic	T3/IIOP deserialization
8009	AJP (Tomcat)	GhostCat (CVE-2020-1938)
1099	RMI Registry	RMI deserialization
1090/8500	JBoss JMX	JMXInvokerServlet
50000	Jenkins	Jenkins CLI deserialization

Phase 2: Exploitation Decision Tree

发现序列化入口
├─ 原生序列化 (rO0AB/aced0005)?
│   ├─ 先 URLDNS 确认漏洞存在 → [references/ysoserial-gadgets.md](references/ysoserial-gadgets.md)
│   └─ 逐个尝试 CC1-7 → CommonsBeanutils → Spring → Groovy
├─ Fastjson (@type 字段)?
│   └─ 识别版本 → 选择对应 payload → [references/jndi-fastjson.md](references/jndi-fastjson.md)
├─ Shiro (rememberMe=deleteMe)?
│   └─ 默认密钥 kPH+bIxk5D2deZiIxcaaaA== → [references/jndi-fastjson.md](references/jndi-fastjson.md)
└─ Log4j (Java 应用 + 用户输入)?
    └─ ${jndi:ldap://...} → [references/jndi-fastjson.md](references/jndi-fastjson.md)

Notes

• First use URLDNS for detection, and after confirming the vulnerability exists, try command execution gadgets
• ysoserial's Runtime.exec() does not support pipes/redirection; the command needs to be Base64-encoded
• The Java version affects the JNDI exploitation method (JDK < 8u191 is the simplest; 8u191+ requires a local Gadget)
• Try multiple gadget chains one by one; different classpath environments are suitable for different gadgets