直接进去ysoserial的URLDNS利用链条，可以看到主要是一个getObject的方法。

使用了URLStreamHandler类来进行网络连接和获取地址。

new了一个hashmap的对象，看hashmap的readobject方法。

private void readObject(java.io.ObjectInputStream s)

        throws IOException, ClassNotFoundException {

        // Read in the threshold (ignored), loadfactor, and any hidden stuff

        s.defaultReadObject();

        reinitialize();

        if (loadFactor <= 0 || Float.isNaN(loadFactor))

            throw new InvalidObjectException("Illegal load factor: " +

                                             loadFactor);

        s.readInt();                // Read and ignore number of buckets

        int mappings = s.readInt(); // Read number of mappings (size)

        if (mappings < 0)

            throw new InvalidObjectException("Illegal mappings count: " +

                                             mappings);

        else if (mappings > 0) { // (if zero, use defaults)

            // Size the table using given load factor only if within

            // range of 0.25...4.0

            float lf = Math.min(Math.max(0.25f, loadFactor), 4.0f);

            float fc = (float)mappings / lf + 1.0f;

            int cap = ((fc < DEFAULT_INITIAL_CAPACITY) ?

                       DEFAULT_INITIAL_CAPACITY :

                       (fc >= MAXIMUM_CAPACITY) ?

                       MAXIMUM_CAPACITY :

                       tableSizeFor((int)fc));

            float ft = (float)cap * lf;

            threshold = ((cap < MAXIMUM_CAPACITY && ft < MAXIMUM_CAPACITY) ?

                         (int)ft : Integer.MAX_VALUE);

 

            // Check Map.Entry[].class since it's the nearest public type to

            // what we're actually creating.

            SharedSecrets.getJavaOISAccess().checkArray(s, Map.Entry[].class, cap);

            @SuppressWarnings({"rawtypes","unchecked"})

            Node<K,V>[] tab = (Node<K,V>[])new Node[cap];

            table = tab;

 

            // Read the keys and values, and put the mappings in the HashMap

            for (int i = 0; i < mappings; i++) {

                @SuppressWarnings("unchecked")

                    K key = (K) s.readObject();

                @SuppressWarnings("unchecked")

                    V value = (V) s.readObject();

                putVal(hash(key), key, value, false, false);

            }

        }

通过putVal进入到hash方法

static final int hash(Object key) {
int h;
return (key == null) ? 0 : (h = key.hashCode()) ^ (h >>> 16);
}

定义了一个key参数。最后调用了key参数的hashcode方法。意思就是，我们只需要找到一个类的hashcode方法是可以利用的即可。putval方法会对其进行反序列化。

在URLDNS里使用的是java.net.URL的hashcode方法

URL u = new URL(null, url, handler);

 该方法首先对hashcode的值进行了判断。返回值之后调用了URLStreamHandler的hashcode方法。

调用了gethostaddress方法，跟进。

 

 

gethost获取ip，getByName使用远程请求来获取主机的ip地址。