Other nomination
Java Exploitation Restrictions in Modern JDK Times
With Nashorn removed in Java 15, ScriptEngineManager payloads stop working, so this uses the JShell API with fully qualified class names to run arbitrary Java in-process without spawning a child process. It also shows JDK 16 module encapsulation and reflection lockdown break ysoserial gadgets: --add-opens fixes payload building but not the victim, so TemplatesImpl chains no longer fire.
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.