archive/ysoserial
1
0
Fork 0
mirror of https://github.com/frohoff/ysoserial.git synced 2026-09-21 22:50:46 +08:00
Code Issues Packages Projects Releases Wiki Activity
160 Commits 8 Branches 10 Tags
d367e379d961c18bff28fd2c888a2c8fe0dc6e63
Commit Graph
160 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Chris Frohoff 74254d2cc7 Merge pull request #44 from mbechler/master 
Test fixes, some minor stuff
 2016-07-25 09:38:03 -07:00
Chris Frohoff 09603ef5ed Merge pull request #49 from jacob-baines/jython-general 
A more generalized Jython1
 2016-07-25 09:36:16 -07:00
Chris Frohoff e90e8725b4 Merge pull request #50 from matthiaskaiser/master 
Adding general CC gadget that works with IBM and Oracle JRE
 2016-07-25 09:35:16 -07:00
matthiaskaiser 39ea0590fb Adding general CC gadget that works with IBM and Oracle JRE 2016-07-04 16:32:51 +02:00
Jacob Baines f924363559 A more generalized Jython1 use case 2016-06-26 20:38:25 -04:00
mbechler c61106f69f Some minor improvements 
- Let JRMPListener dump the object id used in DGC calls.
- Allow full specification of JDNI name in Hibernate2, accordingly fix JRMPReverseConnectTest
- Randomize object id in JRMLClient payload for increased reliability (and side channel)
 2016-05-14 10:29:39 +02:00
mbechler c7a3f8c65c Fix tests 
- extract version checking code
- add version check for AnnotationInvocationHandler usage
- add java.rmi.server.useCodebaseOnly=false to surefire system properties
 2016-05-14 10:04:56 +02:00
Chris Frohoff 8adc168dc0 Merge pull request #34 from gitter-badger/gitter-badge 
Add a Gitter chat badge to README.md
 2016-03-18 08:53:00 -07:00
The Gitter Badger e8b739c383 Add Gitter badge 2016-03-18 15:51:49 +00:00
Chris Frohoff 1bd7e9e488 disabling jython test 2016-03-13 17:19:30 -07:00
Chris Frohoff 0b402d2bee Merge pull request #29 from pwntester/jython_gadget 
Rebased Jython Gadget
 2016-03-13 16:42:51 -07:00
Alvaro Muñoz 097179b703 Rebased Jython Gadget 2016-03-14 00:30:31 +01:00
Chris Frohoff 2650ab6093 skip cc5 test for now 2016-03-13 12:28:06 -07:00
Chris Frohoff 3be56c7ac8 Merge pull request #26 from jasinner/AnnotationInvocationHandler 
workaround for issue 17
 2016-03-13 12:19:54 -07:00
Chris Frohoff 4b798a1d6e Merge pull request #20 from mbechler/cleanup 
Cleaned up version of #14
 2016-03-13 12:12:41 -07:00
mbechler 3230c080ff Add rome (RSS/Atom library) gadget chain. 
Add exploit and test code for JRMP reverse connect remote classloading.
 2016-03-12 17:35:17 +01:00
Jason Shepherd 5d9e0e9eca workaround for issue 17 2016-03-11 10:56:16 +10:00
mbechler bdb1e0db3d Add some tooling docs 2016-03-09 15:30:04 +01:00
mbechler 6873a43409 Drop empty javadocs. 2016-03-09 14:11:15 +01:00
Chris Frohoff c86d134f14 Merge pull request #21 from nikaiw/master 
Fix method name in the usage part of the documentation
 2016-03-07 10:39:45 -08:00
nk acc264faa7 Fix method name in the usage part of the documentation 2016-03-07 18:05:46 +01:00
mbechler 2d6962162b Made json-lib gadget chain more reliable. 2016-03-07 11:35:52 +01:00
mbechler 3273b27c75 JRMPListener Java6 compatiblity. 2016-03-06 19:32:08 +01:00
mbechler eabfce0dc2 Disable json-lib test as the gadget chain depends on the HashMap ordering which seemingly is different 
across JDK versions.
 2016-03-06 19:24:32 +01:00
mbechler b814712e19 Fix HashMap creation for java7. 2016-03-06 18:53:39 +01:00
mbechler 4795bce7ff Add hook for payload generators to modify the object before finalizers are called 
(to fix the fileupload test and also to prevent exploiting yourself, also may be
useful for finalizer based gadgets)
 2016-03-06 15:50:59 +01:00
mbechler 5fc361df4f A final touch 2016-03-06 14:54:49 +01:00
mbechler 8beeec6594 Add JBoss/Wildfly exploitation client. 2016-03-06 14:54:49 +01:00
mbechler 37dbcf57e4 Fix fileupload test reliability 2016-03-06 14:54:49 +01:00
mbechler c94779b83d Add jenkins client and exploits (CVE-2016-0788) 2016-03-06 14:54:49 +01:00
mbechler 6bb0d80aa0 Some cleanup of myfaces gadgets. 2016-03-06 14:54:49 +01:00
mbechler 7879428d9c Add MyFaces gadgets. 
Add ability to provide a custom deserializer (needed for setting up the faces context)
 2016-03-06 14:54:49 +01:00
mbechler d6658809cf Move payload annotation to annotation package. 2016-03-06 14:54:49 +01:00
mbechler bba1460cb6 Remove wrong copyright notices, again 2016-03-06 14:54:49 +01:00
mbechler c8e82237fe Add C3P0 gadget chain. 
Add remote classloading test harness.
 2016-03-06 14:54:49 +01:00
mbechler 20580e918d Add commons fileupload file operation gadget chain. 2016-03-06 14:54:49 +01:00
mbechler 6f9c8dca2b Rename beanutils gadget 2016-03-06 14:54:49 +01:00
mbechler 4130fc5545 Add spring variant and json-lib gadget chain. 2016-03-06 14:54:49 +01:00
mbechler bd21624609 Add hibernate gadget chains. 
Remove missed copyright notices.
 2016-03-06 14:54:49 +01:00
mbechler 436e831cbd Add JRMP utilties, gadgets and test code. 2016-03-06 14:54:49 +01:00
mbechler 8dfce7ed73 Add custom test infrastructure. 2016-03-06 14:54:49 +01:00
mbechler 7157d5e297 Some basic cleanups (warnings, imports) 
Add controlled instantiation constructor utility.
 2016-03-06 14:54:49 +01:00
mbechler a69ce66e69 Add ability to generate TemplatesImpl payloads with an actual non-shaded xalan implementation. 2016-03-06 14:53:30 +01:00
Chris Frohoff 48338fb6e7 Merge pull request #4 from ltearno/patch-1 
Call setAccessible only once
 2016-03-04 01:07:00 -08:00
Chris Frohoff 39574362ad Merge pull request #13 from pwntester/master 
BeanShell exploit
 2016-02-27 16:09:01 -08:00
Alvaro Muñoz c616a23428 BeanShell exploit 2016-02-27 23:50:11 +01:00
Chris Frohoff adb16e1e09 bump version to next snapshot 2016-02-25 07:47:28 -08:00
Chris Frohoff 87c91b27a0 added beanutils gadget chain, release 0.0.4 v0.0.4 2016-02-24 14:26:00 -08:00
Chris Frohoff 2c79998485 remove cruft 2016-02-24 13:57:41 -08:00
Chris Frohoff ed18a40523 updated README v0.0.3 2016-01-26 17:27:19 -08:00