Freaks City

When sending HTTP requests, the Content-Type header must match the data format being sent: JSON Format: Content-Type: application/json Request body: {"mobile_phone":"13164761466","pwd":"123456789"} Usage: json=json_data Form Data Format: Content-Type: aplication/x-www-form-urlencoded Request body: mobile_ ...

Challenge 801: Flask Debugger PIN Exploitation This challenge demonstrates calculating the debugger PIN for a Flask application running in debug mode. The target exposes the console endpoint and allows file reading through a query parameter. First, retrieve the machine ID components: # Node ID from network interface /file?filename=/sys/class/ne ...

Channel Initialization and Deserialization Entry Point The Channel class constructor invokes setup() to initialize the communication channel. Within this method, a background thread is spawned via new ReaderThread(receiver).start() to handle incoming data. @Override public void setup(Channel channel, CommandReceiver receiver) { this.channel ...

Environment Setup Java version: 1.8.0_65 Apache Commons Collections: 3.2.2 Vulnerability Overview The CC1 gadget chain leverages the Transformer interface in Apache Commons Collections to achieve remote code execution (RCE) during Java deserialization when untrusted data is processed. Exploitation Details Step 1: Command Execution Primitive T ...

Environment Both CC4 and CC2 chains require Commons Collections version 4.0. <dependency> <groupId>org.apache.commons</groupId> <artifactId>commons-collections4</artifactId> <version>4.0</version> </dependency> This analysis focuses on the red half of the chain, which can be realized ...

After the previous analysis of the complete process, we now have a better understanding of RMI. This article focuses on JDK versions prior to JEP 290, specifically JDK 8u66, where no filtering is applied. It analyzes all possible attack methods. The next article will specifically discuss bypass techniques. The perspective here is that of an att ...

Setting Up the HTTP Client A customized RestTemplate bean provides fine-graineed control over connection behavior. The configuration below binds a request factory with a timeout setting. import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.http.client.SimpleC ...

XStream is a popular Java library for serializing objects to XML and back. However, versions prior to 1.4.15 (and certain later patches) are vulnerable to deserialization attacks that can lead to remote code execution. This article explores the internals of XStream's deserialization mechanism and demonstrates how three critical CVEs (CVE-2021-2 ...

Effective exploitation via Java deserialization often hinges on bypassing access controls and instantiating objects without invoking standard constructors. The ysoserial toolkit addresses these challenges through specialized utility classes, primarily located in the payloads.util package. Two critical components facilitate these operations: Ref ...