archive/ysoserial
1
0
Fork 0
mirror of https://github.com/frohoff/ysoserial.git synced 2026-09-22 07:00:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

readme updates

Browse Source
This commit is contained in:
Chris Frohoff
2015-01-29 08:14:15 -08:00
parent f3e0ca6456
commit 1c82fda4e4
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+7 -2
View File
@@ -9,8 +9,9 @@ A proof-of-concept tool for generating payloads that exploit unsafe Java object
Released as part of AppSecCali 2015 Talk ["Marshalling Pickles: how deserializing objects will ruin your day"](http://www.slideshare.net/frohoff1/appseccali-2015-marshalling-pickles)
ysoserial is a collection of utilities and property-oriented programming "gadget chains" discovered in common java
libraries. The main driver program takes a user-specified command and wraps it in the user-specified gadget chain, then
__ysoserial__ is a collection of utilities and property-oriented programming "gadget chains" discovered in common java
libraries that can, under the right conditions, exploit Java applications performing __unsafe deserialization__ of objects.
The main driver program takes a user-specified command and wraps it in the user-specified gadget chain, then
serializes these objects to stdout. When an application with the required gadgets on the classpath unsafely deserializes
this data, the chain will automatically be invoked and cause the command to be executed on the application host.
@@ -59,6 +60,10 @@ $ java -cp ysoserial-0.0.1-all.jar ysoserial.RMIRegistryExploit myhost 1099 Comm
1. Download the latest jar from the "releases" section.
## Code Status
[![Build Status](https://travis-ci.org/frohoff/ysoserial.svg?branch=master)](https://travis-ci.org/frohoff/ysoserial)
## Contributing
1. Fork it