Skip to content

Instantly share code, notes, and snippets.

@yehgdotnet
Last active March 12, 2018 08:35
Show Gist options
  • Save yehgdotnet/320fdaa3387c7269f4c639f604e1ffd5 to your computer and use it in GitHub Desktop.
Save yehgdotnet/320fdaa3387c7269f4c639f604e1ffd5 to your computer and use it in GitHub Desktop.
java.util.map hijacking
import java.util.*;
public class utilMap {
public static void showExample(){
Map<Integer,String> map=new HashMap<Integer,String>();
map.put(100,"Amit");
map.put(101,"Vijay");
map.put(102,"Rahul}\r\n{103 Attacker}\r\n{"); // attacker's controlled value
System.out.println(map);
}
}
Output:
{100=Amit, 101=Vijay, 102=Rahul}
{103 Attacker}
{}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment