https://th3b0ywh0l1v3d.github.io/tags/java/ Recent content in Java on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/reversing/leftover-leftovers/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/reversing/leftover-leftovers/ A two-stage Java AOT-cache app whose integrity hash covers bytecode and pointers but not the archived heap — patching the pre-resolved heap String redirects the image directory and reads /flag. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/reversing/leftovers/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/reversing/leftovers/ Reversing a Javalin app whose real password validator lives in an AOT/CDS cache that overrides the jar — dumping the loaded class with the HotSpot Serviceability Agent unlocks a file-read to /flag.