A New Attack Interface in Java Applications
summary
Finds multiple concrete JDBC attack paths and ready POCs rather than theory. An IBM driver exposes a JNDI injection via writable connection properties and a POC triggers lookup-based RCE. Several drivers let traces write files so a malicious JSP is planted and executed; a memory web shell is injected by writing bytecode using a BCEL transformer. Dynamic analysis plus a custom Gadget Inspector finds one-arg gadget constructors for deserialization; fake SSO servers trick Snowflake and Teradata into calling runtime.exec. Bugs reported to vendors; Google reward $500.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 0:57jdbc and gndi
- 2:16gndi properties
- 3:15analyze
- 10:07Memory Web Shell
- 12:51Memory Backdoor
- 13:14Exclude Command
- 13:37Lexical Syntax Compatibility
- 13:50Blobs
- 18:47Java Native Interface
- 23:40Dynamic Analysis Tools
- 25:31Snowflake JDS
- 26:15Review
- 29:33JSON
- 30:50HTC Password
- 31:09Teradata JDBC Driver
- 34:48Java Reflection
- 35:15YouTubes Gadget
- 35:32Java Reflection Limitations
- 36:10JDB Connection Properties
- 36:37WhiteSOCR
- 37:01Low List
- 38:38JDC Driver
related talks
48mA Journey From JNDI/LDAP Manipulation to Remote Code Execution Dream Land
51mNew Exploit Technique In Java Deserialization Attack
56mThe Anatomy of Java Vulnerabilities
26mStranger Danger: Your Attack Surface Just Got Bigger
50mStranger Danger: Your Java Attack Surface Just Got Bigger
47mThe Hidden Security Hazards in Your Java Stack
49mThe Anatomy of Java Vulnerabilities
48mThe Hidden Security Hazards in Your Java Stack