search

frohoff / ysoserial

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
http://frohoff.github.io/appseccali-marshalling-pickles/
MIT License
7.65k stars 1.74k forks source link

A tool for fuzzing the right payload #207

Closed nirzaaa closed 5 months ago

nirzaaa commented 1 year ago

Hi guys!

While working on a PortSwigger lab, I had the problem of finding which payload should work in my case. For this scenario I created this tool that helps to do the job for us automatically: https://github.com/nirzaaa/LookingSerial

Video explanation about the tool: https://www.youtube.com/watch?v=NAK_a324dco&list=PLGj3IZkhXGzL7SQII47kmo9OO3wsFPaVv&index=3

Your are more than welcome to take a look and leave a comment with your feedback and such,

Have a good one,

nirza

frohoff commented 5 months ago

Very cool tool, thank you for sharing. In the future please use the discussions feature for questions, comments, or troubleshooting not related to a bug.

https://github.com/frohoff/ysoserial/discussions

nirzaaa commented 5 months ago

Very cool tool, thank you for sharing. In the future please use the discussions feature for questions, comments, or troubleshooting not related to a bug.

https://github.com/frohoff/ysoserial/discussions

Thank you for the kind words :) I can definitely post there and delete this issue, was a mistake on my side. Since then I also added a section on how to modify the script for specific cases too.

Have a good one,

nirza

nirzaaa commented 5 months ago

Very cool tool, thank you for sharing. In the future please use the discussions feature for questions, comments, or troubleshooting not related to a bug.

https://github.com/frohoff/ysoserial/discussions

Hi :)

I hope I used the right place now, let me know what you think :)

https://github.com/frohoff/ysoserial/discussions/224

It really helped me and hope it will help others too, taking this great tool to the next level 💪