mbechler
3230c080ff
Add rome (RSS/Atom library) gadget chain.
...
Add exploit and test code for JRMP reverse connect remote classloading.
2016-03-12 17:35:17 +01:00
mbechler
bdb1e0db3d
Add some tooling docs
2016-03-09 15:30:04 +01:00
mbechler
6873a43409
Drop empty javadocs.
2016-03-09 14:11:15 +01:00
mbechler
2d6962162b
Made json-lib gadget chain more reliable.
2016-03-07 11:35:52 +01:00
mbechler
3273b27c75
JRMPListener Java6 compatiblity.
2016-03-06 19:32:08 +01:00
mbechler
eabfce0dc2
Disable json-lib test as the gadget chain depends on the HashMap ordering which seemingly is different
...
across JDK versions.
2016-03-06 19:24:32 +01:00
mbechler
b814712e19
Fix HashMap creation for java7.
2016-03-06 18:53:39 +01:00
mbechler
4795bce7ff
Add hook for payload generators to modify the object before finalizers are called
...
(to fix the fileupload test and also to prevent exploiting yourself, also may be
useful for finalizer based gadgets)
2016-03-06 15:50:59 +01:00
mbechler
5fc361df4f
A final touch
2016-03-06 14:54:49 +01:00
mbechler
8beeec6594
Add JBoss/Wildfly exploitation client.
2016-03-06 14:54:49 +01:00
mbechler
c94779b83d
Add jenkins client and exploits (CVE-2016-0788)
2016-03-06 14:54:49 +01:00
mbechler
6bb0d80aa0
Some cleanup of myfaces gadgets.
2016-03-06 14:54:49 +01:00
mbechler
7879428d9c
Add MyFaces gadgets.
...
Add ability to provide a custom deserializer (needed for setting up the faces context)
2016-03-06 14:54:49 +01:00
mbechler
d6658809cf
Move payload annotation to annotation package.
2016-03-06 14:54:49 +01:00
mbechler
c8e82237fe
Add C3P0 gadget chain.
...
Add remote classloading test harness.
2016-03-06 14:54:49 +01:00
mbechler
20580e918d
Add commons fileupload file operation gadget chain.
2016-03-06 14:54:49 +01:00
mbechler
6f9c8dca2b
Rename beanutils gadget
2016-03-06 14:54:49 +01:00
mbechler
4130fc5545
Add spring variant and json-lib gadget chain.
2016-03-06 14:54:49 +01:00
mbechler
bd21624609
Add hibernate gadget chains.
...
Remove missed copyright notices.
2016-03-06 14:54:49 +01:00
mbechler
436e831cbd
Add JRMP utilties, gadgets and test code.
2016-03-06 14:54:49 +01:00
mbechler
8dfce7ed73
Add custom test infrastructure.
2016-03-06 14:54:49 +01:00
mbechler
7157d5e297
Some basic cleanups (warnings, imports)
...
Add controlled instantiation constructor utility.
2016-03-06 14:54:49 +01:00
mbechler
a69ce66e69
Add ability to generate TemplatesImpl payloads with an actual non-shaded xalan implementation.
2016-03-06 14:53:30 +01:00
Chris Frohoff
48338fb6e7
Merge pull request #4 from ltearno/patch-1
...
Call setAccessible only once
2016-03-04 01:07:00 -08:00
Alvaro Muñoz
c616a23428
BeanShell exploit
2016-02-27 23:50:11 +01:00
Chris Frohoff
87c91b27a0
added beanutils gadget chain, release 0.0.4
2016-02-24 14:26:00 -08:00
Chris Frohoff
2c79998485
remove cruft
2016-02-24 13:57:41 -08:00
Chris Frohoff
0e99a197c6
jre7u21 gadget chain, refactors
2016-01-26 17:18:32 -08:00
Arnaud Tournier
5b4b8a3320
Call setAccessible only once
...
In the getField method, due to recursion, the field.setAccessible was called a number of times equal to the number of level to go up the hierarchy to find the field
2015-12-11 16:32:32 +01:00
Chris Frohoff
79219f7792
fixed spring, commons-collections4 payloads, made test cases more robust
2015-01-29 21:33:26 -08:00
Chris Frohoff
e6565b61e3
init-commit
2015-01-28 11:31:57 -08:00
mbechler