参考链接
========================================

官方文档
----------------------------------------
- `ognl <http://commons.apache.org/proper/commons-ognl/>`_
- `Java SE Security Guide <https://docs.oracle.com/javase/9/security/toc.htm>`_

反序列化
----------------------------------------
- `Java反序列化漏洞从入门到深入 <https://mp.weixin.qq.com/s/nNTw3HMnkX63d9ybdx3USQ>`_
- `Java反序列化漏洞通用利用分析 <https://blog.chaitin.cn/2015-11-11_java_unserialize_rce/>`_
- `JRE8u20反序列化漏洞分析 <http://www.freebuf.com/vuls/176672.html>`_
- `WebLogic反序列化漏洞漫谈 <https://www.freebuf.com/articles/web/169770.html>`_
- `从WebLogic看反序列化漏洞的利用与防御 <https://cert.360.cn/report/detail?id=c8eed4b36fe8b19c585a1817b5f10b9e>`_
- `JSON反序列化之殇 <https://github.com/shengqi158/fastjson-remote-code-execute-poc/blob/master/Java_JSON%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E4%B9%8B%E6%AE%87_%E7%9C%8B%E9%9B%AA%E5%AE%89%E5%85%A8%E5%BC%80%E5%8F%91%E8%80%85%E5%B3%B0%E4%BC%9A.pdf>`_
- `浅析Java序列化和反序列化 <https://xz.aliyun.com/t/3847>`_

沙箱
----------------------------------------
- `Java Sandbox Escape <http://phrack.org/papers/escaping_the_java_sandbox.html>`_

框架
----------------------------------------
- `Struts <https://github.com/apache/struts>`_
- `Struts Examples <https://github.com/apache/struts-examples>`_

其他
----------------------------------------
- `关于 JNDI 注入 <https://paper.seebug.org/417/>`_
- `Java RMI与RPC的区别 <https://www.cnblogs.com/ygj0930/p/6542811.html>`_