Research Update Enhanced src/pentesting-web/deserialization/...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL:
• Blog Title: Research Update Enhanced src/pentesting-web/deserialization/basic-java-deserialization-objectinputstream-readobject.md
• Suggested Section: Research

🎯 Content Summary

Research Update for src/pentesting-web/deserialization/basic-java-deserialization-objectinputstream-readobject.md

This PR contains automated research updates including:

• Latest security vulnerabilities and attack vectors
• Updated techniques and tools
• Enhanced explanations and examples
• Additional references and resources

Generated by: HackTricks Research Agent
Timestamp: 2026-03-29 13:13:45 UTC

Tool usage

• apply_patch: 1
• brave_search: 11
• exec: 22
• search_google_...

🔧 Technical Details

Research update for HackTricks content

🤖 Agent Actions

I’m starting with the target page and nearby deserialization material so I can see what is already covered before adding anything. After that I’ll do external research and only patch additions that materially improve this specific page.
The target page already has some recent material, but it mixes a basic readObject() example with a partially updated “what’s new” section that needs verification. I’m checking adjacent HackTricks deserialization pages now so I can avoid repeating coverage that already exists elsewhere.
I have the local scope now. Next I’m validating which of the “2023-2025” claims on the page are strong enough to keep, and I’m looking for a couple of better additions that fit this exact ObjectInputStream/readObject() page instead of the sibling pages.
The external results are enough to narrow the update. I’m now pulling the primary sources and commit/docs text directly so I can replace weak or overly broad claims with specific, defensible guidance.
I have enough to edit now. The main changes will be: remove a few weakly-supported tool/version claims, tighten the recent examples around real trust-boundary failures, and add concrete modern hardening/visibility guidance that is specific to ObjectInputStream and readObject().
The content patch is in place. I’m doing a final pass on the rendered structure and diff now; the only verification gap so far is that markdownlint is not installed in this environment, so I’m validating with direct file/diff checks instead.
Updated basic-java-deserialization-objectinputstream-readobject.md.

I replaced the weaker “2023-2025” claims with verified recent trust-boundary examples, added a new section on readObject() anti-patterns that still create gadget entrypoints, tightened the mitigation guidance around ObjectInputFilter/JEP 290/JEP 415 with a concrete per-stream example, and replaced the shakier tooling/debug notes with a more defensible research workflow. I also added an internal reference to the existing URLDNS/GadgetProbe page so this page stays focused and avoids duplicating sibling content.

Verification was done with direct file inspection and git diff. markdownlint is not installed here, so I could not run an automated Markdown lint pass.

Research URLs used:

• https://openjdk.org/jeps/415
• https://openjdk.org/jeps/290
• https://spring.io/security/cve-2023-34040/
• https://securitylab.github.com/advisories/GHSL-2023-044_Aerospike_Java_Client/
• https://github.com/aerospike/aerospike-client-java/commit/80c508cc5ecb0173ce92d7fab8cfab5e77bd9900.patch
• https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/io/Serial.html
• https://securitylab.github.com/advisories/GHSL-2022-085_pac4j/
• https://www.redhat.com/en/blog/jdk-approach-address-deserialization-vulnerability
• https://bugs.openjdk.org/browse/JDK-8273215
• https://inside.java/2021/03/02/monitoring-deserialization-activity-in-the-jdk/

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post:

Content Categories: Based on the analysis, this content was categorized under "Research".

Repository Maintenance:

• MD Files Formatting: 963 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0