archive/ysoserial
1
0
Fork 0
mirror of https://github.com/frohoff/ysoserial.git synced 2026-09-24 16:01:54 +08:00
Code Issues Packages Projects Releases Wiki Activity
241 Commits 8 Branches 10 Tags
cb0fa86a997658b77a29fcc7600a43084c6387f5
Commit Graph
132 Commits
Author SHA1 Message Date
tint0 04c198a3d0 getDeclaredField raises exception instead of returning null when field isn't found 
(cherry picked from commit 348d873)
 2019-01-30 13:21:47 +07:00
tint0 6ba90d2d83 New rhino gadget 
(cherry picked from commit 7533f65)
 2019-01-30 13:21:25 +07:00
Chris Frohoff f31677fbc3 Merge pull request #91 from supersache/vaadingadget 
Vaadin gadget
 2018-11-19 23:38:08 -08:00
Chris Frohoff ecdac3988b troubleshooting travis jdk6 build 2018-11-19 08:22:36 -08:00
Chris Frohoff 548857e3f6 jdk10+ compile fixes 2018-11-16 18:08:51 -08:00
Chris Frohoff 3f4922505f fix for jdk10+ 2018-11-16 17:44:28 -08:00
Chris Frohoff 986647e372 more robust java version parsing 2018-11-16 17:35:24 -08:00
Chris Frohoff 6909d5269d retry on failure for flaky gadgets/tests 2018-11-16 11:40:23 -08:00
Chris Frohoff fd911d0969 fix (hopefully) test flakiness 2018-11-16 11:02:44 -08:00
Chris Frohoff 377216a525 disable some gadgets/tests for jdk6 2018-11-16 10:47:29 -08:00
Chris Frohoff 09440ff356 fix build for jdk6 2018-11-16 10:23:03 -08:00
Chris Frohoff 4088b8cda2 remove serialization-stage secmgr to avoid spurious errors due to extra surefire thread 2018-11-15 13:17:25 -08:00
supersache e0b15a3961 additional dependency added, precondition badattrvalexcobj 2018-09-20 13:00:21 +02:00
supersache 614fcfeb2a Changed from TemplatesImpl to Object 2018-09-19 15:08:27 +02:00
supersache 58e578b0f6 Changes for the new Vaadin Gadget 2018-09-19 14:55:56 +02:00
Félix Martel-Denis 99f463cc69 hibernate3 payload (#88) 2018-09-12 08:25:06 -07:00
Nicky Bloor 477ecb8f05 Add support for exploiting SSL RMI services. (#81) 
* Add support for exploiting SSL RMI services.

* Make PMD happy.
 2018-04-23 08:49:47 -07:00
Chris Frohoff 3f352eacc6 bumping up wait time 2017-09-07 21:41:14 -07:00
Chris Frohoff 80b0d2f368 fixed broken tests 2017-09-03 23:40:17 -07:00
Chris Frohoff 8a330853c6 test/author fixes 2017-09-03 11:19:05 -07:00
Chris Frohoff fa0ba6031c Merge pull request #55 from SkylarWatson/file_upload_test 
Updated payload args in FileUploadTest to match what production code …
 2017-09-03 10:32:46 -07:00
Chris Frohoff 028ee30e9c fixes, refactoring 2017-09-02 20:57:11 -07:00
Chris Frohoff 35bce8fe45 Merge pull request #68 from JackOfMostTrades/clojure-gadget 
Add a gadget chain for exploiting the presence of clojure.
 2017-07-19 10:38:12 -07:00
Ian Haken 4cb0a5a17a Add a gadget chain for exploiting the presence of clojure. 2017-07-08 09:40:26 -07:00
Philippe Arteau f379338272 URLDNS: Small fix to avoid DNS resolution while generating the payload 2017-05-23 17:45:04 -04:00
Gabriel Lawrence 12a9f56d01 Add URLDNS gadget, that uses the argument as a URL to trigger a DNS lookup. 2017-03-27 01:34:28 +00:00
Skylar 8ad9b583a6 Updated payload args in FileUploadTest to match what production code is looking for; Added Intellij project files to .gitignore 2016-08-14 19:52:32 -05:00
Matthias Kaiser 436d2040e4 Merge branch 'master' of https://github.com/frohoff/ysoserial 2016-07-29 12:39:26 +02:00
Matthias Kaiser a62a266df5 Updated names 2016-07-29 12:36:02 +02:00
Chris Frohoff bbebd8bd64 Merge pull request #53 from jacob-baines/fileupload2 
FileUpload2
 2016-07-28 10:06:11 -07:00
Jacob Baines d8bef9642a Rename FileUpload2 to Wicket1 2016-07-28 09:03:05 -04:00
Matthias Kaiser 2e6f61c039 Adding a Javassist/Weld/JBossInterceptor gadgets to ysoserial. 2016-07-26 17:11:11 +02:00
Matthias Kaiser 0f9526ff24 Adding a Javassist/Weld/JBossInterceptor gadgets to ysoserial. 2016-07-26 16:42:46 +02:00
Matthias Kaiser 8698844034 Adding a Javassist/Weld gadget to ysoserial. 2016-07-26 16:15:42 +02:00
Matthias Kaiser 2ae8b051a5 Adding the RhinoGadget to ysoserial. 
The gadget uses the standalone version of Rhino ("org.mozilla.javascript.*"-namespace).
 2016-07-26 14:48:09 +02:00
Jacob Baines 0fb8d8d222 Don't use API introduced in Java 7 2016-07-25 18:09:31 -04:00
Jacob Baines 6f3dd217c7 Created FileUpload2 based on Apache Wicket's version of DiskFileItem. Also changed FileUpload1 to support Windows filepaths 2016-07-25 14:15:39 -04:00
Chris Frohoff 74254d2cc7 Merge pull request #44 from mbechler/master 
Test fixes, some minor stuff
 2016-07-25 09:38:03 -07:00
Chris Frohoff 09603ef5ed Merge pull request #49 from jacob-baines/jython-general 
A more generalized Jython1
 2016-07-25 09:36:16 -07:00
matthiaskaiser 39ea0590fb Adding general CC gadget that works with IBM and Oracle JRE 2016-07-04 16:32:51 +02:00
Jacob Baines f924363559 A more generalized Jython1 use case 2016-06-26 20:38:25 -04:00
mbechler c61106f69f Some minor improvements 
- Let JRMPListener dump the object id used in DGC calls.
- Allow full specification of JDNI name in Hibernate2, accordingly fix JRMPReverseConnectTest
- Randomize object id in JRMLClient payload for increased reliability (and side channel)
 2016-05-14 10:29:39 +02:00
mbechler c7a3f8c65c Fix tests 
- extract version checking code
- add version check for AnnotationInvocationHandler usage
- add java.rmi.server.useCodebaseOnly=false to surefire system properties
 2016-05-14 10:04:56 +02:00
Chris Frohoff 1bd7e9e488 disabling jython test 2016-03-13 17:19:30 -07:00
Alvaro Muñoz 097179b703 Rebased Jython Gadget 2016-03-14 00:30:31 +01:00
Chris Frohoff 2650ab6093 skip cc5 test for now 2016-03-13 12:28:06 -07:00
Chris Frohoff 3be56c7ac8 Merge pull request #26 from jasinner/AnnotationInvocationHandler 
workaround for issue 17
 2016-03-13 12:19:54 -07:00
mbechler 3230c080ff Add rome (RSS/Atom library) gadget chain. 
Add exploit and test code for JRMP reverse connect remote classloading.
 2016-03-12 17:35:17 +01:00
Jason Shepherd 5d9e0e9eca workaround for issue 17 2016-03-11 10:56:16 +10:00
mbechler bdb1e0db3d Add some tooling docs 2016-03-09 15:30:04 +01:00