From 1c82fda4e4902a194baa3041f4fa746c8fd35620 Mon Sep 17 00:00:00 2001 From: Chris Frohoff Date: Thu, 29 Jan 2015 08:14:15 -0800 Subject: [PATCH] readme updates --- README.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 4a99883..556a16a 100644 --- a/README.md +++ b/README.md @@ -9,8 +9,9 @@ A proof-of-concept tool for generating payloads that exploit unsafe Java object Released as part of AppSecCali 2015 Talk ["Marshalling Pickles: how deserializing objects will ruin your day"](http://www.slideshare.net/frohoff1/appseccali-2015-marshalling-pickles) -ysoserial is a collection of utilities and property-oriented programming "gadget chains" discovered in common java -libraries. The main driver program takes a user-specified command and wraps it in the user-specified gadget chain, then +__ysoserial__ is a collection of utilities and property-oriented programming "gadget chains" discovered in common java +libraries that can, under the right conditions, exploit Java applications performing __unsafe deserialization__ of objects. +The main driver program takes a user-specified command and wraps it in the user-specified gadget chain, then serializes these objects to stdout. When an application with the required gadgets on the classpath unsafely deserializes this data, the chain will automatically be invoked and cause the command to be executed on the application host. @@ -59,6 +60,10 @@ $ java -cp ysoserial-0.0.1-all.jar ysoserial.RMIRegistryExploit myhost 1099 Comm 1. Download the latest jar from the "releases" section. +## Code Status + +[![Build Status](https://travis-ci.org/frohoff/ysoserial.svg?branch=master)](https://travis-ci.org/frohoff/ysoserial) + ## Contributing 1. Fork it