shiroPoc

shiroPoc copied to clipboard

λ java -cp shiroPoc-0.5-SNAPSHOT-jar-with-dependencies.jar CommonsCollections10 SpringBootEcho1 错误: 找不到或无法加载主类 CommonsCollections10 原因: java.lang.ClassNotFoundException: CommonsCollections10

websecer


yshdxm

Bumps httpclient from 4.5.9 to 4.5.13. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a...

dependabot[bot]

Bumps commons-io from 2.6 to 2.7. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a...

dependabot[bot]

师傅可以试试把gcm算法加入其中，最近也见到了好多gcm的站）

yuligesec

exp存在强特征被防火墙拦截

1

命令执行exp使用了cmd作为HTTP请求头，某些防火墙发现存在这个请求包后会拦截。

lovelyjuice

检测某个站出现误报情况

1

``` Powered by UnicodeSec Version 0.0.2 八月 01, 2020 4:31:56 下午 org.apache.http.client.protocol.ResponseProcessCookies processCookies 警告: Invalid cookie header: "Set-Cookie: 8VY9p00ccvVgS=5s7CnSS.ODpwYT_v50JzmQn.x0G6eIvX0a8hwJN_WEumAi_mwmJTdsCMnZzgt1NxHtMXnLqaQe.bUAFr1uZ83Cq; Path=/; expires=Tue, 3 0 Jul 2030 08:32:54 GMT; HttpOnly". Invalid 'expires'...

hahaSec

原始请求  生成POC后  另外，大佬这个怎么自定义命令，默认是whoami，我测试的这个靶机没回显的，想修改为其他命令测试

liao10086

jar包命令行无法scan

1


Ch1ngg

`java -cp shiroPoc-0.5-SNAPSHOT-jar-with-dependencies.jar org.unicodesec.poc http://localhost:8080/` 直接使用jar检测的话，测试时发现bug，无论对任何URL检测都会返回成功 

ffpepwowa