search

frohoff / ysoserial

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
http://frohoff.github.io/appseccali-marshalling-pickles/
MIT License
7.77k stars 1.76k forks source link

Add parameterized payloads #219

Open cas1n opened 8 months ago

cas1n commented 8 months ago

Hello,

This PR (based on the multiarg branch) adds parameters to customize payloads of gadget chains based on Translets and on CommonsCollections Transformers:

Examples: 

$ java -jar ysoserial.jar CommonsCollections1 --inline 'System.out.println("Hello world");'
[...]

$ java -jar ysoserial.jar CommonsBeanutils1  --jar-file /path/to/app.jar --jar-main org.random.Main -- arg0 arg1 arg2
[...]