One Day Sec

What is the purpose of enumerating JspServletWrapper instances, and how is it achieved via reflection?

Enumerating JspServletWrapper instances allows attackers to locate and manipulate compiled JSP servlets, potentially for webshell persistence or removal. The article demonstrates how to traverse from the request object through `_scope`, `_servlet`, and `rctxt` to reach a `ConcurrentHashMap` of JSP wrappers. A related technique is covered in Java Exploitation Techniques – Self-Deletion of Webshell Compiled Files via Reflection.
JspServletWrapperreflectionConcurrentHashMapwebshellexploitation

Browse all Q&A →