https://souljian.cn/tags/%E5%AE%89%E5%85%A8%E5%8E%9F%E7%90%86/Recent content in 安全原理 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088163/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088163/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>反序列化攻击只在授权测试环境进行。</p> <h2 id="一反序列化攻击链">一、反序列化攻击链 </h2><img src="https://souljian.cn/img/deserialization-chain.svg" alt="反序列化攻击链" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 序列化 → ② 网络传输/存储 → ③ 反序列化 → ④ 触发恶意代码 → ⑤ RCE </span></span></code></pre></td></tr></table> </div> </div><h2 id="二java-反序列化">二、Java 反序列化 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">ObjectInputStream.readObject() → 触发 readObject() 方法 </span></span><span class="line"><span class="cl">→ 调用 Gadget 链 → Runtime.exec() → RCE </span></span></code></pre></td></tr></table> </div> </div><h2 id="三php-反序列化">三、PHP 反序列化 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-php" data-lang="php"><span class="line"><span class="cl"><span class="nx">unserialize</span><span class="p">(</span><span class="nv">$_GET</span><span class="p">[</span><span class="s1">&#39;data&#39;</span><span class="p">]);</span> </span></span><span class="line"><span class="cl"><span class="nx">__wakeup</span><span class="p">()</span> <span class="o">/</span> <span class="nx">__destruct</span><span class="p">()</span> <span class="o">/</span> <span class="nx">__toString</span><span class="p">()</span> <span class="nx">魔术方法触发</span> <span class="nx">RCE</span> </span></span></code></pre></td></tr></table> </div> </div><h2 id="四防御方法">四、防御方法 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">白名单：只允许反序列化可信类 </span></span><span class="line"><span class="cl">签名验证：序列化数据加签名 </span></span><span class="line"><span class="cl">使用 JSON 替代：避免二进制序列化 </span></span><span class="line"><span class="cl">升级框架：修复已知 Gadget 链 </span></span></code></pre></td></tr></table> </div> </div><h2 id="五小结">五、小结 </h2><p>反序列化漏洞本质是<strong>不可信数据被反序列化</strong>。防御核心是<strong>不反序列化不可信数据</strong>。</p>