I am looking to get started with Java exploitation. I have not found a good place start or even how to start, so I am asking here. What are the publicly available exploits for Java that one can study ? Also what would be a good starting point ?(ex. maybe decompilation )
What are the publicly available exploits for Java that one can study ?
There are about 20 publicly available exploits for Java here, with annotated source code and references to the vulnerabilities being exploited: https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/browser
So the first question is, what are you trying to exploit?
Historically, the most popular target is the Java Browser plugin, because the sandboxing relies entirely on in-process Java code, with an attack surface of over 18,000 classes in the standard library. Naturally, this means that it's a frequent source of vulnerabilities, to the point where a lot of people have just disabled the plugin entirely, and even Oracle has made it harder to run applets automatically.
So if you want to find your own vulnerability, it's just a matter of looking through the standard library code (everything in rt.jar is privileged) and find something that does sensitive operations without properly validating the caller's permissions.