archive/ysoserial
1
0
Fork 0
mirror of https://github.com/frohoff/ysoserial.git synced 2026-09-21 22:50:46 +08:00
Code Issues Packages Projects Releases Wiki Activity
132 Commits 8 Branches 10 Tags
7adb3cfe638228ae0bd2baf7584dc7d3f2831f17
Commit Graph
132 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Chris Frohoff 6088aa3f20 Merge pull request #70 from relaxnow/patch-1 
Update README.md to reflect additional payloads
 2017-09-02 12:47:51 -07:00
Boy Baukema 55800d1e3a Update README.md to reflect additional payloads 2017-08-10 11:10:39 +02:00
Chris Frohoff 35bce8fe45 Merge pull request #68 from JackOfMostTrades/clojure-gadget 
Add a gadget chain for exploiting the presence of clojure.
 2017-07-19 10:38:12 -07:00
Ian Haken 4cb0a5a17a Add a gadget chain for exploiting the presence of clojure. 2017-07-08 09:40:26 -07:00
Chris Frohoff ca38b73711 Merge pull request #67 from h3xstream/master 
URLDNS: Small fix to avoid DNS resolution while generating the payload
 2017-06-09 10:15:14 -07:00
Philippe Arteau f379338272 URLDNS: Small fix to avoid DNS resolution while generating the payload 2017-05-23 17:45:04 -04:00
Chris Frohoff 5bd2ced110 Merge pull request #66 from gebl/master 
Add URLDNS gadget, that uses the argument as a URL to trigger a DNS l…
 2017-03-26 19:19:56 -07:00
Gabriel Lawrence 12a9f56d01 Add URLDNS gadget, that uses the argument as a URL to trigger a DNS lookup. 2017-03-27 01:34:28 +00:00
Chris Frohoff ad26e2bd46 links to jitpack jars, note about release removal, build instructions 2016-10-19 11:33:38 -07:00
Skylar 8ad9b583a6 Updated payload args in FileUploadTest to match what production code is looking for; Added Intellij project files to .gitignore 2016-08-14 19:52:32 -05:00
Chris Frohoff d143b8cbfb Merge pull request #52 from matthiaskaiser/master 
Adding the RhinoGadget, Javassist/Weld, JBossInterceptors  Gadget to ysoserial.
 2016-07-29 09:28:06 -07:00
Matthias Kaiser 436d2040e4 Merge branch 'master' of https://github.com/frohoff/ysoserial 2016-07-29 12:39:26 +02:00
Matthias Kaiser a62a266df5 Updated names 2016-07-29 12:36:02 +02:00
Chris Frohoff bbebd8bd64 Merge pull request #53 from jacob-baines/fileupload2 
FileUpload2
 2016-07-28 10:06:11 -07:00
Jacob Baines d8bef9642a Rename FileUpload2 to Wicket1 2016-07-28 09:03:05 -04:00
Matthias Kaiser 2e6f61c039 Adding a Javassist/Weld/JBossInterceptor gadgets to ysoserial. 2016-07-26 17:11:11 +02:00
Matthias Kaiser 0f9526ff24 Adding a Javassist/Weld/JBossInterceptor gadgets to ysoserial. 2016-07-26 16:42:46 +02:00
Matthias Kaiser 8698844034 Adding a Javassist/Weld gadget to ysoserial. 2016-07-26 16:15:42 +02:00
Matthias Kaiser 2ae8b051a5 Adding the RhinoGadget to ysoserial. 
The gadget uses the standalone version of Rhino ("org.mozilla.javascript.*"-namespace).
 2016-07-26 14:48:09 +02:00
Chris Frohoff 80b21d9cb3 Merge pull request #51 from jacob-baines/jython_java6 
Fix Jython1 Breaking Java 6
 2016-07-25 16:57:38 -07:00
Jacob Baines 0fb8d8d222 Don't use API introduced in Java 7 2016-07-25 18:09:31 -04:00
Jacob Baines 6f3dd217c7 Created FileUpload2 based on Apache Wicket's version of DiskFileItem. Also changed FileUpload1 to support Windows filepaths 2016-07-25 14:15:39 -04:00
Chris Frohoff 74254d2cc7 Merge pull request #44 from mbechler/master 
Test fixes, some minor stuff
 2016-07-25 09:38:03 -07:00
Chris Frohoff 09603ef5ed Merge pull request #49 from jacob-baines/jython-general 
A more generalized Jython1
 2016-07-25 09:36:16 -07:00
Chris Frohoff e90e8725b4 Merge pull request #50 from matthiaskaiser/master 
Adding general CC gadget that works with IBM and Oracle JRE
 2016-07-25 09:35:16 -07:00
matthiaskaiser 39ea0590fb Adding general CC gadget that works with IBM and Oracle JRE 2016-07-04 16:32:51 +02:00
Jacob Baines f924363559 A more generalized Jython1 use case 2016-06-26 20:38:25 -04:00
mbechler c61106f69f Some minor improvements 
- Let JRMPListener dump the object id used in DGC calls.
- Allow full specification of JDNI name in Hibernate2, accordingly fix JRMPReverseConnectTest
- Randomize object id in JRMLClient payload for increased reliability (and side channel)
 2016-05-14 10:29:39 +02:00
mbechler c7a3f8c65c Fix tests 
- extract version checking code
- add version check for AnnotationInvocationHandler usage
- add java.rmi.server.useCodebaseOnly=false to surefire system properties
 2016-05-14 10:04:56 +02:00
Chris Frohoff 8adc168dc0 Merge pull request #34 from gitter-badger/gitter-badge 
Add a Gitter chat badge to README.md
 2016-03-18 08:53:00 -07:00
The Gitter Badger e8b739c383 Add Gitter badge 2016-03-18 15:51:49 +00:00
Chris Frohoff 1bd7e9e488 disabling jython test 2016-03-13 17:19:30 -07:00
Chris Frohoff 0b402d2bee Merge pull request #29 from pwntester/jython_gadget 
Rebased Jython Gadget
 2016-03-13 16:42:51 -07:00
Alvaro Muñoz 097179b703 Rebased Jython Gadget 2016-03-14 00:30:31 +01:00
Chris Frohoff 2650ab6093 skip cc5 test for now 2016-03-13 12:28:06 -07:00
Chris Frohoff 3be56c7ac8 Merge pull request #26 from jasinner/AnnotationInvocationHandler 
workaround for issue 17
 2016-03-13 12:19:54 -07:00
Chris Frohoff 4b798a1d6e Merge pull request #20 from mbechler/cleanup 
Cleaned up version of #14
 2016-03-13 12:12:41 -07:00
mbechler 3230c080ff Add rome (RSS/Atom library) gadget chain. 
Add exploit and test code for JRMP reverse connect remote classloading.
 2016-03-12 17:35:17 +01:00
Jason Shepherd 5d9e0e9eca workaround for issue 17 2016-03-11 10:56:16 +10:00
mbechler bdb1e0db3d Add some tooling docs 2016-03-09 15:30:04 +01:00
mbechler 6873a43409 Drop empty javadocs. 2016-03-09 14:11:15 +01:00
Chris Frohoff c86d134f14 Merge pull request #21 from nikaiw/master 
Fix method name in the usage part of the documentation
 2016-03-07 10:39:45 -08:00
nk acc264faa7 Fix method name in the usage part of the documentation 2016-03-07 18:05:46 +01:00
mbechler 2d6962162b Made json-lib gadget chain more reliable. 2016-03-07 11:35:52 +01:00
mbechler 3273b27c75 JRMPListener Java6 compatiblity. 2016-03-06 19:32:08 +01:00
mbechler eabfce0dc2 Disable json-lib test as the gadget chain depends on the HashMap ordering which seemingly is different 
across JDK versions.
 2016-03-06 19:24:32 +01:00
mbechler b814712e19 Fix HashMap creation for java7. 2016-03-06 18:53:39 +01:00
mbechler 4795bce7ff Add hook for payload generators to modify the object before finalizers are called 
(to fix the fileupload test and also to prevent exploiting yourself, also may be
useful for finalizer based gadgets)
 2016-03-06 15:50:59 +01:00
mbechler 5fc361df4f A final touch 2016-03-06 14:54:49 +01:00
mbechler 8beeec6594 Add JBoss/Wildfly exploitation client. 2016-03-06 14:54:49 +01:00