search

gwen001 / offsectools_www

A vast collection of security tools and resources curated by the community.
https://offsec.tools
180 stars 23 forks source link

[addtool] ysoserial #266

Closed gwen001 closed 1 year ago

gwen001 commented 1 year ago

[link]https://github.com/frohoff/ysoserial[/link] [short_descr]Generates payloads that exploit unsafe Java object deserialization.[/short_descr] [tags]deserialization,java,exploit,payloads[/tags] [long_descr]ysoserial is a collection of utilities and property-oriented programming "gadget chains" discovered in common java libraries that can, under the right conditions, exploit Java applications performing unsafe deserialization of objects. The main driver program takes a user-specified command and wraps it in the user-specified gadget chain, then serializes these objects to stdout. When an application with the required gadgets on the classpath unsafely deserializes this data, the chain will automatically be invoked and cause the command to be executed on the application host.[/long_descr] ysoserial

gwen001 commented 1 year ago

Issue correctly handled, tool is waiting for human validation.

gwen001 commented 1 year ago

Tool has been accepted: https://offsec.tools/tool/ysoserial

Thank you!