The Swiss Army Knife of Java Exploitation: Building Highly Customizable Payload Exploit Chains
No ratings
Presented at Out of The Box 2025 by
This topic explores how to further explore the potential of Java vulnerability exploitation on the basis of the existing results, and move from "0 to 1" breakthroughs to "1 to 10" in-depth exploitation. Java security researchers usually use Proof of Concept (POC) to verify the feasibility of vulnerabilities. However, POCs often face limitations in real-world environments, so turning a POC into an Exploit (Exp) that can actually be exploited is a critical step. By reviewing the classic vulnerabilities in Java, we found that many of the Gadgets in the exploit chain are highly generic. Meanwhile, for the limitations that may exist in different target environments, we propose a framework for generating and exploiting highly customizable Java Payloads, aiming to better translate the research results into practical applications.