Skip to content

Commit

Permalink
Add parameterized payloads
Browse files Browse the repository at this point in the history
- Add supplementary arguments for internal translet based payloads
- Add supplementary arguments for Transformer payloads
- Make CommonsBeanutils1 silent using NullComparator
  • Loading branch information
cas1n committed Mar 12, 2024
1 parent 778e4e2 commit 29ba250
Showing 1 changed file with 19 additions and 1 deletion.
20 changes: 19 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,12 +34,20 @@ for the development of effective defensive techniques, and is not intended to be
used to attack systems except where explicitly authorized. Project maintainers
are not responsible or liable for misuse of the software. Use responsibly.

## Dependencies issues

As stated in [BishopFox's fork](https://github.com/BishopFox/ysoserial-bf?tab=readme-ov-file#missing-javaxinterceptor-api-library),
javax.interceptor-api library version 3.1 was a bump version typo and was removed from central repositories.
As a result, artifacts cannot be downloaded anymore.

You can find this library and a workaround to fix this issue [here](https://github.com/BishopFox/ysoserial-bf?tab=readme-ov-file#missing-javaxinterceptor-api-library).

## Usage

```shell
$ java -jar ysoserial.jar
Y SO SERIAL?
Usage: java -jar ysoserial.jar [payload] '[command]'
Usage: java -jar ysoserial-[version]-all.jar [payload] [arguments ...]
Available payload types:
Payload Authors Dependencies
------- ------- ------------
Expand Down Expand Up @@ -79,6 +87,16 @@ Usage: java -jar ysoserial.jar [payload] '[command]'
Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4
```

A few arguments were added to customize gadget chains relying on Translets or CommonsCollections Transformers:

```shell
$ java -jar ysoserial.jar CommonsCollections1 --inline 'System.out.println("Hello world");'
[...]

$ java -jar ysoserial.jar CommonsBeanutils1 --jar-file /path/to/app.jar --jar-main org.random.Main -- arg0 arg1 arg2
[...]
```

## Examples

```shell
Expand Down

0 comments on commit 29ba250

Please sign in to comment.