参考链接
========================================

官方文档
----------------------------------------
- `ognl <http://commons.apache.org/proper/commons-ognl/>`_
- `Java SE Security Guide <https://docs.oracle.com/javase/9/security/toc.htm>`_
- `Java RMI Release Notes for JDK 6 <https://docs.oracle.com/javase/7/docs/technotes/guides/rmi/relnotes.html>`_
- `Java Release Notes for JDK 7 <https://www.oracle.com/technetwork/java/javase/7u21-relnotes-1932873.html>`_

反序列化
----------------------------------------
- `Java反序列化漏洞从入门到深入 <https://mp.weixin.qq.com/s/nNTw3HMnkX63d9ybdx3USQ>`_
- `Java反序列化漏洞通用利用分析 <https://blog.chaitin.cn/2015-11-11_java_unserialize_rce/>`_
- `JRE8u20反序列化漏洞分析 <http://www.freebuf.com/vuls/176672.html>`_
- `WebLogic反序列化漏洞漫谈 <https://www.freebuf.com/articles/web/169770.html>`_
- `从WebLogic看反序列化漏洞的利用与防御 <https://cert.360.cn/report/detail?id=c8eed4b36fe8b19c585a1817b5f10b9e>`_
- `JSON反序列化之殇 <https://github.com/shengqi158/fastjson-remote-code-execute-poc/blob/master/Java_JSON%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E4%B9%8B%E6%AE%87_%E7%9C%8B%E9%9B%AA%E5%AE%89%E5%85%A8%E5%BC%80%E5%8F%91%E8%80%85%E5%B3%B0%E4%BC%9A.pdf>`_
- `浅析Java序列化和反序列化 <https://xz.aliyun.com/t/3847>`_
- `Commons Collections Java反序列化漏洞深入分析 <https://security.tencent.com/index.php/blog/msg/97>`_
- `FAR SIDES OF JAVA REMOTE PROTOCOLS <https://i.blackhat.com/eu-19/Wednesday/eu-19-An-Far-Sides-Of-Java-Remote-Protocols.pdf>`_

沙箱
----------------------------------------
- `Java Sandbox Escape <http://phrack.org/papers/escaping_the_java_sandbox.html>`_

框架
----------------------------------------
- `Struts <https://github.com/apache/struts>`_
- `Struts Examples <https://github.com/apache/struts-examples>`_
- `Eclipse Jetty <https://github.com/eclipse/jetty.project>`_

RMI
----------------------------------------
- `Java RMI与RPC的区别 <https://www.cnblogs.com/ygj0930/p/6542811.html>`_
- `Remote Method Invocation (RMI) <https://www.oreilly.com/library/view/learning-java/1565927184/ch11s04.html>`_
- `Java 中 RMI、JNDI、LADP、JRMP、JMX、JMS那些事儿 <https://paper.seebug.org/1091>`_
- `Oracle: Developing T3 Clients <http://docs.oracle.com/cd/E11035_01/wls100/client/t3.html>`_

JNDI
----------------------------------------
- `Overview of JNDI <https://docs.oracle.com/javase/tutorial/jndi/overview/index.html>`_
- `关于 JNDI 注入 <https://paper.seebug.org/417/>`_
- `A Journey From JNDI LDAP Manipulation To RCE <https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf>`_
- ` 如何绕过高版本JDK的限制进行JNDI注入 <https://www.freebuf.com/column/207439.html>`_