Collected research

Java Exploitation Restrictions in Modern JDK Times

With Nashorn removed in Java 15, ScriptEngineManager payloads stop working, so this uses the JShell API with fully qualified class names to run arbitrary Java in-process without spawning a child process. It also shows JDK 16 module encapsulation and reflection lockdown break ysoserial gadgets: --add-opens fixes payload building but not the victim, so TemplatesImpl chains no longer fire.

Record

Published by

codewhitesec.blogspot.com

Topic

Server

In the archive

• Collected in the 2023 research round

Tags

• deserialization
• gadget-chain
• rce
• java
• tooling
• prior-art-extension
• detection
• owasp-a08-2021
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of codewhitesec.blogspot.com, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.