archive/ysoserial
1
0
Fork 0
mirror of https://github.com/frohoff/ysoserial.git synced 2026-09-26 17:01:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

added link to talk slides

Browse Source
This commit is contained in:
Chris Frohoff
2015-01-28 11:58:14 -08:00
parent e6565b61e3
commit 58f3804a39
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2
View File
@@ -7,6 +7,8 @@ A proof-of-concept tool for generating payloads that exploit unsafe Java object
## Description ## Description
Released as part of AppSecCali 2015 Talk ["Marshalling Pickles: how deserializing objects will ruin your day"](http://www.slideshare.net/frohoff1/appseccali-2015-marshalling-pickles)
ysoserial is a collection of utilities and property-oriented programming "gadget chains" discovered in common java ysoserial is a collection of utilities and property-oriented programming "gadget chains" discovered in common java
libraries. The main driver program takes a user-specified command and wraps it in the user-specified gadget chain, then libraries. The main driver program takes a user-specified command and wraps it in the user-specified gadget chain, then
serializes these objects to stdout. When an application with the required gadgets on the classpath unsafely deserializes serializes these objects to stdout. When an application with the required gadgets on the classpath unsafely deserializes