https://h40vv3n.github.io/

1<!DOCTYPE html><html lang="zh-CN"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=2"><meta name="theme-color" content="#222"><meta http-equiv="X-UA-COMPATIBLE" content="IE=edge,chrome=1"><meta name="renderer" content="webkit"><link rel="icon" type="image/ico" sizes="32x32" href="/assets/favicon.ico"><link rel="apple-touch-icon" sizes="180x180" href="/assets/apple-touch-icon.png"><link rel="alternate" href="/rss.xml" title="保持谦逊" type="application/rss+xml"><link rel="alternate" href="/atom.xml" title="保持谦逊" type="application/atom+xml"><link rel="alternate" type="application/json" title="保持谦逊" href="http://example.com/feed.json"><link rel="preconnect" href="https://lf9-cdn-tos.bytecdntp.com"><link rel="preconnect" href="https://at.alicdn.com"><link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Mulish:400,400italic,700,700italic%7CFredericka%20the%20Great:400,400italic,700,700italic%7CNoto%20Serif%20JP:400,400italic,700,700italic%7CNoto%20Serif%20SC:400,400italic,700,700italic%7CInconsolata:400,400italic,700,700italic&amp;display=swap&amp;subset=latin,latin-ext" media="none" onload="this.media='all'"><link rel="stylesheet" href="/css/app.css?v=0.4.4"><link rel="modulepreload" href="/js/chunk-AQJDXJYY.js"><link rel="modulepreload" href="/js/chunk-ICONY7DL.js"><link rel="modulepreload" href="/js/chunk-P6MM2YDM.js"><link rel="modulepreload" href="/js/chunk-R4V4O42L.js"><link rel="modulepreload" href="/js/index.esm-MXM77TKH.js"><link rel="modulepreload" href="/js/post-LRTLKV55.js"><link rel="modulepreload" href="/js/quicklink-SMLSC7AY.js"><link rel="modulepreload" href="/js/search-IDGSJYRG.js"><link rel="modulepreload" href="/js/siteInit.js"><link rel="preload" href="https://i.imgtg.com/2023/03/09/YQSYM.jpg" as="image" fetchpriority="high"><link rel="preload" href="https://i.imgtg.com/2023/03/09/Y0kTl.jpg" as="image" fetchpriority="high"><link rel="preload" href="https://i.imgtg.com/2023/03/09/YSj7p.jpg" as="image" fetchpriority="high"><link rel="preload" href="https://i.imgtg.com/2023/03/09/YS6XY.jpg" as="image" fetchpriority="high"><link rel="preload" href="https://i.imgtg.com/2023/03/09/Y0zdB.jpg" as="image" fetchpriority="high"><link rel="preload" href="https://i.imgtg.com/2023/03/09/Y0xvg.jpg" as="image" fetchpriority="high"><meta name="description" content="这个人很懒，什么都不愿说"><link rel="canonical" href="http://example.com/"><title>Y1 h40vv3n = 保持谦逊</title><meta name="generator" content="Hexo 7.2.0"></head><body itemscope="" itemtype="http://schema.org/WebPage"><div id="loading"><div class="cat"><div class="body"></div><div class="head"><div class="face"></div></div><div class="foot"><div class="tummy-end"></div><div class="bottom"></div><div class="legs left"></div><div class="legs right"></div></div><div class="paw"><div class="hands left"></div><div class="hands right"></div></div></div></div><div id="container"><header id="header" itemscope="" itemtype="http://schema.org/WPHeader"><div class="inner"><div id="brand"><div class="pjax"><a class="logo" href="/" rel="start"><p class="artboard">Y1 h40vv3n</p><h1 class="title" itemprop="name headline">保持谦逊</h1></a></div></div><nav id="nav"><div class="inner"><div class="toggle"><div class="lines" aria-label="切换导航栏"><span class="line"></span><span class="line"></span><span class="line"></span></div></div><ul class="menu"><li class="item title"><a href="/" rel="start">Y1 h40vv3n</a></li></ul><ul class="right" id="rightNav"><li class="item theme"><i class="ic i-sun"></i></li><li class="item search"><i class="ic i-search"></i></li></ul></div></nav></div><div class="pjax" id="imgs"><ul><li class="item" style="background-image: url(&quot;https://i.imgtg.com/2023/03/09/YQSYM.jpg&quot;);"></li><li class="item" style="background-image: url(&quot;https://i.imgtg.com/2023/03/09/Y0kTl.jpg&quot;);"></li><li class="item" style="background-image: url(&quot;https://i.imgtg.com/2023/03/09/YSj7p.jpg&quot;);"></li><li class="item" style="background-image: url(&quot;https://i.imgtg.com/2023/03/09/YS6XY.jpg&quot;);"></li><li class="item" style="background-image: url(&quot;https://i.imgtg.com/2023/03/09/Y0zdB.jpg&quot;);"></li><li class="item" style="background-image: url(&quot;https://i.imgtg.com/2023/03/09/Y0xvg.jpg&quot;);"></li></ul></div></header><div id="waves"><svg class="waves" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewB

1ox="0 24 150 28" preserveAspectRatio="none" shape-rendering="auto"><defs><path id="gentle-wave" d="M-160 44c30 0 58-18 88-18s 58 18 88 18 58-18 88-18 58 18 88 18 v44h-352z"></path></defs><g class="parallax"><use xlink:href="#gentle-wave" x="48" y="0"></use><use xlink:href="#gentle-wave" x="48" y="3"></use><use xlink:href="#gentle-wave" x="48" y="5"></use><use xlink:href="#gentle-wave" x="48" y="7"></use></g></svg></div><main><div class="inner"><div class="pjax" id="main"><div class="index wrap"><h2 class="divider">文章列表</h2><div class="segments posts"><article class="item"><div class="cover"><a href="/2024/09/05/typecho-xss/" itemprop="url" title="typecho_xss"><img loading="lazy" decoding="async" data-src="https://i.imgtg.com/2023/03/09/YS2LU.jpg" alt="article cover"></a></div><div class="info"><div class="meta"><span class="item" title="创建时间：2024-09-05 15:00:06"><span class="icon"><i class="ic i-calendar"></i></span><time itemprop="dateCreated datePublished" datetime="2024-09-05T15:00:06+08:00">2024-09-05</time></span><span class="item" title="本文字数"><span class="icon"><i class="ic i-pen"></i></span><span>3k</span><span class="text">字</span></span><span class="item" title="阅读时长"><span class="icon"><i class="ic i-clock"></i></span><span>3 分钟</span></span></div><h3><a href="/2024/09/05/typecho-xss/" itemprop="url" title="typecho_xss">typecho_xss</a></h3><div class="excerpt"># Typecho Blogging Platform
2
3Typecho is a PHP-based blog software and is designed to be the most powerful blog engine in the world. Typecho is released under the GNU General Public License 2.0.
4
5Link address：https://github.com/typecho/typecho/
6This open source project has an</div><a href="/2024/09/05/typecho-xss/" class="btn" itemprop="url" title="typecho_xss">more...</a></div></article><article class="item"><div class="cover"><a href="/2024/07/01/URLDNS-Deserialize/" itemprop="url" title="URLDNS-Deserialize"><img loading="lazy" decoding="async" data-src="https://i.imgtg.com/2023/03/09/Y0kTl.jpg" alt="article cover"></a></div><div class="info"><div class="meta"><span class="item" title="创建时间：2024-07-01 13:51:50"><span class="icon"><i class="ic i-calendar"></i></span><time itemprop="dateCreated datePublished" datetime="2024-07-01T13:51:50+08:00">2024-07-01</time></span><span class="item" title="本文字数"><span class="icon"><i class="ic i-pen"></i></span><span>3.7k</span><span class="text">字</span></span><span class="item" title="阅读时长"><span class="icon"><i class="ic i-clock"></i></span><span>3 分钟</span></span></div><h3><a href="/2024/07/01/URLDNS-Deserialize/" itemprop="url" title="URLDNS-Deserialize">URLDNS-Deserialize</a></h3><div class="excerpt"># URLDNS 链分析
7
8URLDNS 链是 ysoserial 中的一条利用链，通常用于监测是否存在 Java 反序列化漏洞，该链有如下特点：
91、不限制 jdk 版本，使用 java 内置的类，无第三方依赖要求
102、目标无回显，可通过 DNS 请求验证是否存在反序列化漏洞
113、该条链只能用来发起 DNS 请求，不能够进行其他利用
12
13该条链子的漏洞的 sink 点为 Java 内置的 java.net.URL  类，该类的 hasCode()  方法会调用 getHostAddress()  方法对目标 host 进行 DNS 解析请求
14首先来看下 hasCode()  方法，该方法在内部</div><a href="/2024/07/01/URLDNS-Deserialize/" class="btn" itemprop="url" title="URLDNS-Deserialize">more...</a></div></article><article class="item"><div class="cover"><a href="/2024/06/26/Fastjson-Deserialize/" itemprop="url" title="Fastjson-Deserialize"><img loading="lazy" decoding="async" data-src="https://i.imgtg.com/2023/03/09/Y0zdB.jpg" alt="article cover"></a></div><div class="info"><div class="meta"><span class="item" title="创建时间：2024-06-26 11:43:51"><span class="icon"><i class="ic i-calendar"></i></span><time itemprop="dateCreated datePublished" datetime="2024-06-26T11:43:51+08:00">2024-06-26</time></span><span class="item" title="本文字数"><span class="icon"><i class="ic i-pen"></i></span><span>15k</span><span class="text">字</span></span><span class="item" title="阅读时长"><span class="icon"><i class="ic i-clock"></i></span><span>13 分钟</span></span></div><h3><a href="/2024/06/26/Fastjson-Deserialize/" itemprop="url" title="Fastjson-Deserialize">Fastjson-Deserialize</a></h3><div class="excerpt"># Fastjson-1.2.24
15
16影响版本： fastjson &lt;= 1.2.24  描述：fastjson 默认使用  @type  指定反序列化任意类，攻击者可以通过在 Java 常见环境中寻找能够构造恶意类的方法，通过反序列化的过程中调用的 getter/setter 方法，以及目标成员变量的注入来达到传参的目的，最终形成恶意调用链。
17
18payload:
19{	"@type": "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",	"</div><a href="/2024/06/26/Fastjson-Deserialize/" class="btn" itemprop="url" title="Fastjson-Deserialize">more...</a></div></article><article class="item"><div class="cover"><a href="/2024/06/24/hello-world/" itemprop="url" title="Hello World"><img loading="lazy" decoding="async" data-src="https://i.imgtg.com/2023/03/09/Y0xvg.jpg" alt="article cover"></a></div><div class="info"><div class="meta"><span class="item" title="创建时间：2024-06-24 20:26:44"><span class="icon"><i class="ic i-calendar"></i></span><time itemprop="dateCreated datePublished" datetime="2024-06-24T20:26:44+08:00">2024-06-24</time></span><span class="item" title="本文字数"><span class="icon"><i class="ic i-pen"></i></span><span>811</span><span class="text">字</span></span><span class="item" title="阅读时长"><span class="icon"><i class="ic i-clock"></i></span><span>1 分钟</span></span></div><h3><a href="/2024/06/24/hello-world/" itemprop="url" title="Hello World">Hello World</a></h3><div class="excerpt">Welcome to Hexo! This is your very first post. Check documentation for more info. If you get any problems when using Hexo, you can find the answer in troubleshooting or you can ask me on GitHub.
20# Quick Start
21# Create a new post
22h$ hexo new "My New Post"More info: Writing
23# Run server
24h$ h</div><a href="/2024/06/24/hello-world/" class="btn" itemprop="url" title="Hello World">more...</a></div></article></div></div></div><div id="sidebar"><div class="inner"><div class="panels"><div class="inner"><div class="contents panel pjax" data-title="文章目录"></div><div class="related panel pjax" data-title="系列文章"></div><div class="overview panel" data-title="站点概览"><div class="author" itemprop="author" itemscope="itemscope" itemtype="http://schema.org/Person"><img class="image" loading="lazy" decoding="async" itemprop="image" alt="h40vv3n" src="/assets/avatar.webp"><p class="name" itemprop="name">h40vv3n</p><div class="description" itemprop="description">这个人很懒，什么都不愿说</div></div><nav class="state"><div class="item posts"><a href="/archives/"><span class="count">4</span><span class="name">文章</span></a></div></nav><div class="social"><a target="_blank" rel="noopener" href="https://gitee.com/h40vv3n" class="item github" title="https://gitee.com/h40vv3n"><i class="ic i-github"></i></a><a href="mailto:[email protected]" class="item email" title="mailto:[email protected]"><i class="ic i-envelope"></i></a></div><div class="menu"><li class="item"><a href="/" rel="section"><i class="ic i-home"></i>首页</a></li><li class="item dropdown"><a href="/page/" rel="section"><i class="ic i-user"></i>submenu</a><ul class="submenu"><li class="item"><a href="/page1/" rel="section"><i class="ic i-cloud"></i>link</a></li></ul></li><li class="item"><a href="/page2/" rel="section"><i class="ic i-coffee"></i>link2</a></li></div></div></div></div><ul id="quick"><li class="prev pjax"></li><li class="up"><i class="ic i-arrow-up"></i></li><li class="down"><i class="ic i-arrow-down"></i></li><li class="next pjax"></li><li class="percent"></li></ul></div></div><div class="dimmer"></div></div></main><footer id="footer"><div class="inner"><div class="widgets"><div class="rpost pjax"><h2>随机文章</h2><ul><li class="item"><div class="breadcrumb"></div><span><a href="/2024/06/26/Fastjson-Deserialize/">Fastjson-Deserialize</a></span></li><li class="item"><div class="breadcrumb"></div><span><a href="/2024/07/01/URLDNS-Deserialize/">URLDNS-Deserialize</a></span></li><li class="item"><div class="breadcrumb"></div><span><a href="/2024/09/05/typecho-xss/">typecho_xss</a></span></li><li class="item"><div class="breadcrumb"></div><span><a href="/2024/06/24/hello-world/">Hello World</a></span></li></ul></div></div><div class="status"><div class="copyright">© 2022 -<span itemprop="copyrightYear">2024</span><span class="with-love"><i class="ic i-sakura rotate"></i></span><span class="author" itemprop="copyrightHolder">h40vv3n @ Y1 h40vv3n</span></div><div class="count"><span class="post-meta-item-icon"><i class="ic i-chart-area"></i></span><span title="站点总字数">

2422k 字</span><span class="post-meta-divider"> | </span><span class="post-meta-item-icon"><i class="ic i-coffee"></i></span><span title="站点阅读时长">20 分钟</span></div><div class="powered-by">基于 <a target="_blank" rel="noopener" href="https://hexo.io/">Hexo</a> &amp; Theme.<a target="_blank" rel="noopener" href="https://github.com/theme-shoka-x/hexo-theme-shokaX/">ShokaX</a></div></div></div></footer></div>

24<script data-config="" type="text/javascript">var LOCAL = {
25    ispost: false,
26        path: ``,
27        favicon: {
28        show: `c(˘▽˘c)`,
29        hide: `c(˘△˘c)`
30    },
31    search: {
32        placeholder: "文章搜索",
33        empty: "关于 「 ${query} 」，什么也没搜到",
34        stats: "${time} ms 内找到 ${hits} 条结果"
35    },
36    copy_tex: false,
37    katex: false,
38    mermaid: false,
39    audio: undefined,
40    fancybox: true,
41    nocopy: false,
42    outime: true,
43    template: `<div class="note warning"><p><span class="label warning">文章时效性提示</span><br>这是一篇发布于 {{publish}} 天前，最后一次更新在 {{updated}} 天前的文章，部分信息可能已经发生改变，请注意甄别。</p></div>`,
44    quiz: {
45        choice: `单选题`,
46        multiple: `多选题`,
47        true_false: `判断题`,
48        essay: `问答题`,
49        gap_fill: `填空题`,
50        mistake: `错题备注`
51    },
52    ignores: [
53        (uri) => uri.includes('#'),
54        (uri) => new RegExp(LOCAL.path + '$').test(uri),
55            []
56    ]
57};
58</script>

58<script src="https://lf9-cdn-tos.bytecdntp.com/cdn/expire-6-M/pace/1.2.4/pace.min.js" async=""></script>

58<script src="/js/siteInit.js?v=0.4.4" type="module" fetchpriority="high" defer=""></script>

58</body></html>