Assuming that my Weblogic server is compromised by this vulnerability, what would the traffic pattern look like?

I'm assuming I would see HTTP requests attempting to make connections directly from WebLogic back to the Internet. Could someone provide insight? It is possible that I would see t3 traffic? I don't think an exploited server would attempt to communicate back out using t3.

1 Answer 1


For this CVE, you should see T3 traffic which would contain embedded serialized objects. See the poc for more.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .