[{"data":1,"prerenderedAt":243},["ShallowReactive",2],{"content:\u002F2026\u002Fjava-security-1":3,"surround:\u002F2026\u002Fjava-security-1":237},{"id":4,"title":5,"body":6,"categories":214,"date":216,"description":217,"draft":218,"extension":219,"image":220,"meta":221,"navigation":223,"path":224,"permalink":224,"published":225,"readingTime":226,"recommend":225,"references":225,"seo":231,"sitemap":232,"stem":233,"tags":234,"type":235,"updated":216,"__hash__":236},"content\u002Fposts\u002F2026\u002FJava安全（一）.md","Java安全（一）",{"type":7,"value":8,"toc":198},"minimark",[9,13,17,22,33,87,90,96,119,123,126,163,174,180,183,187,190,192,195],[10,11,12],"h2",{"id":12},"反射",[14,15,16],"p",{},"反射（Reflection）是 Java 的重要机制之一。通过反射，我们可以在程序运行过程中，利用 Class 对象去动态的查看和操作一个类，对我们后续学习类加载机制至关重要，因此，我们选择首先学习反射。",[18,19,21],"h3",{"id":20},"class对象","Class对象",[14,23,24,25,29,30,32],{},"Java 反射是直接对 ",[26,27,28],"code",{"code":28},"Class"," 对象进行操作的，",[26,31,28],{"code":28}," 对象就是 JVM 在运行时用来描述一个类的信息对象，这里有四种方式获取。",[34,35,36,50,63,75],"ol",{},[37,38,39,40],"li",{},"\u003C类名>.class",[41,42,48],"pre",{"className":43,"code":45,"language":46,"meta":47},[44],"language-java","public class Test {\n    public static void main(String[] args) {\n        Class\u003C?> clazz = Test.class;\n    }\n}\n","java","",[26,49,45],{"__ignoreMap":47},[37,51,52,53,56,57],{},"Class.forName()",[54,55],"br",{},"这个需要我们知道一个类的完整类名。",[41,58,61],{"className":59,"code":60,"language":46,"meta":47},[44],"public class Test {\n    public static void main(String[] args) throws ClassNotFoundException {\n        Class\u003C?> clazz = Class.forName(\"com.Test\");\n    }\n}\n",[26,62,60],{"__ignoreMap":47},[37,64,65,66,68,69],{},"\u003C实例>.getClass()",[54,67],{},"通过实例后的对象获取。",[41,70,73],{"className":71,"code":72,"language":46,"meta":47},[44],"public class Test {\n    public static void main(String[] args) {\n        Test test = new Test();\n        Class\u003C?> clazz = test.class;\n    }\n}\n",[26,74,72],{"__ignoreMap":47},[37,76,77,78,80,81],{},"类加载器",[54,79],{},"同样需要完整的类名。",[41,82,85],{"className":83,"code":84,"language":46,"meta":47},[44],"public class Test {\n    public static void main(String[] args) throws ClassNotFoundException {\n        Class\u003C?> clazz = ClassLoader.getSystemClassLoader().loadClass(\"com.test\");\n    }\n}\n",[26,86,84],{"__ignoreMap":47},[14,88,89],{},"这里需要注意的一点是，在对数组对象获取 Class 时，写法有所不同。",[41,91,94],{"className":92,"code":93,"language":46,"meta":47},[44],"Class\u003C?> clazz = double[].class;\nClass\u003C?> clazz = Class.forName(\"[D\");\nClass\u003C?> clazz = Class.forName(\"[[D\");\n",[26,95,93],{"__ignoreMap":47},[14,97,98,99,102,103,106,107,110,111,114,115,118],{},"在调用内部类时，需要使用",[26,100,101],{"code":101},"$","来代替",[26,104,105],{"code":105},".","，如",[26,108,109],{"code":109},"com.Test","类有一个叫做",[26,112,113],{"code":113},"Hello","的内部类，那么调用时类名就为：",[26,116,117],{"code":117},"com.Test$Hello","。",[18,120,122],{"id":121},"api","API",[14,124,125],{},"对于一个类，我们获得到 Class 对象后，就可以通过反射 API 获得一切信息。",[34,127,128,136,145,154],{},[37,129,130,131,133],{},"获取父类",[54,132],{},[26,134,135],{"code":135},"clazz.getSuperclass();",[37,137,138,139],{},"获取字段",[41,140,143],{"className":141,"code":142,"language":46,"meta":47},[44],"Field[] field1 = clazz.getDeclaredFields();\n\u002F\u002F 当前类：所有字段，不包括父类\n\nField[] field2 = clazz.getFields();\n\u002F\u002F 当前类 + 父类：所有 public 字段\n\nField field4 = clazz.getDeclaredField(\"name\");\n\u002F\u002F 当前类：找名字叫 name 的字段，不管 public\u002Fprivate\u002Fprotected\n\nField field3 = clazz.getField(\"name\");\n\u002F\u002F 当前类 + 父类：找名字叫 name 的 public 字段\n",[26,144,142],{"__ignoreMap":47},[37,146,147,148],{},"获取方法",[41,149,152],{"className":150,"code":151,"language":46,"meta":47},[44],"Method[] method1 = clazz.getDeclaredMethods();\n\u002F\u002F 当前类：所有方法，不包括父类\n\nMethod[] method2 = clazz.getMethods();\n\u002F\u002F 当前类 + 父类：所有 public 方法\n\nMethod method4 = clazz.getDeclaredMethod(\"hello\");\n\u002F\u002F 当前类：找名字为 hello 的方法，不管 public\u002Fprivate\u002Fprotected\n\nMethod method3 = clazz.getMethod(\"hello\");\n\u002F\u002F 当前类 + 父类：找名字为 hello 的 public 方法\n",[26,153,151],{"__ignoreMap":47},[37,155,156,157],{},"获取构造方法",[41,158,161],{"className":159,"code":160,"language":46,"meta":47},[44],"Constructor\u003C?>[] constructor1 = clazz.getDeclaredConstructors();\n\u002F\u002F 当前类：所有构造方法，不包括父类\n\nConstructor\u003C?>[] constructor2 = clazz.getConstructors();\n\u002F\u002F 当前类：所有 public 构造方法，不包括父类\n\nConstructor\u003C?> constructor4 = clazz.getDeclaredConstructor(String.class);\n\u002F\u002F 当前类：找参数类型为 String 的构造方法，不管 public\u002Fprivate\u002Fprotected\n\nConstructor\u003C?> constructor3 = clazz.getConstructor(String.class);\n\u002F\u002F 当前类：找参数类型为 String 的 public 构造方法\n",[26,162,160],{"__ignoreMap":47},[14,164,165,166,169,170,173],{},"下面通过 ",[26,167,168],{"code":168},"java.lang.Runtime"," 类进行演示，该类有个 ",[26,171,172],{"code":172},"exec"," 方法可以执行命令，因此许多 payload 都有这个。",[41,175,178],{"className":176,"code":177,"language":46,"meta":47},[44],"import java.io.InputStream;\nimport java.lang.reflect.Constructor;\nimport java.lang.reflect.Method;\n\npublic class Test {\n    public static void main(String[] args) throws Exception {\n        \u002F\u002F 获取 Class 对象\n        Class clazz = Class.forName(\"java.lang.Runtime\");\n\n        \u002F\u002F 获取构造方法\n        Constructor\u003C?> constructor = clazz.getDeclaredConstructor();\n\n        \u002F\u002F 修改访问权限\n        constructor.setAccessible(true);\n\n        \u002F\u002F 创建实例\n        Object runtime = constructor.newInstance();\n\n        \u002F\u002F 获取 exec 方法\n        Method method = runtime.getClass().getMethod(\"exec\", String.class);\n\n        \u002F\u002F 调用 exec\n        Process process = (Process) method.invoke(runtime, \"whoami\");\n\n        \u002F\u002F获取结果\n        InputStream in = process.getInputStream();\n\n        \u002F\u002F 输出\n        byte[] buffer = new byte[1024];\n        int len = in.read(buffer);\n        System.out.println(new String(buffer, 0, len));\n    }\n}\n",[26,179,177],{"__ignoreMap":47},[10,181,182],{"id":182},"类加载机制",[18,184,186],{"id":185},"classloder","Classloder",[18,188,189],{"id":189},"双亲委派机制",[10,191],{"id":47},[10,193,194],{"id":194},"序列化与反序列化",[10,196],{"id":197},"_1",{"title":47,"searchDepth":199,"depth":199,"links":200},4,[201,207,211,212,213],{"id":12,"depth":202,"text":12,"children":203},2,[204,206],{"id":20,"depth":205,"text":21},3,{"id":121,"depth":205,"text":122},{"id":182,"depth":202,"text":182,"children":208},[209,210],{"id":185,"depth":205,"text":186},{"id":189,"depth":205,"text":189},{"id":47,"depth":202,"text":47},{"id":194,"depth":202,"text":194},{"id":197,"depth":202,"text":47},[215],"技术","2026-09-07 17:13:52","先学点基础知识",false,"md","\u002F2026\u002FJava安全（一）\u002Fcover.jpg",{"slots":222},{},true,"\u002F2026\u002Fjava-security-1",null,{"text":227,"minutes":228,"time":229,"words":230},"4 min read",3.675,220500,735,{"title":5,"description":217},{"loc":224},"posts\u002F2026\u002FJava安全（一）",[],"tech","4h52od05Gx6z-9ojXxqiWLZluqneDNcm9JBfB6kX8Ac",[238,225],{"title":239,"path":240,"stem":241,"date":242,"type":235,"children":-1},"Linux 提权","\u002F2026\u002Flinux","posts\u002F2026\u002FLinux 提权","2026-08-05 17:36:30",1788936099640]