ysoserial icon indicating copy to clipboard operation
ysoserial copied to clipboard

Enhancement serialVersionUID + prefix to payload options

Open fl0l0u opened this issue 2 years ago • 0 comments

  1. Implements #182 by overwriting final payload bytes. Attempts to implement a cleaner override using Unsafe or Reflection failed on Object with undefined serial. Usage -s org.apache.commons.beanutils.BeanComparator=-3490850999041592962
  2. Adding feature for prepending arbitrary data to payload. Example payload generated with -p writeUTF=foo -p writeBoolean=true will reach gadget chain deserialization on following code:
String componentId = ois.readUTF();
boolean cancelAction = ois.readBoolean();
ComponentAction action = (ComponentAction) ois.readObject();

fl0l0u avatar Jun 29 '22 11:06 fl0l0u