ysoserial | mvn clean package -DskipTests | Hacking library

by shadowsock5 Java Version: Current License: MIT

X-Ray Key Features Code Snippets Community Discussions(1)Vulnerabilities Install Support

kandi X-RAY | ysoserial Summary

ysoserial is a Java library typically used in Security, Hacking applications. ysoserial has build file available, it has a Permissive License and it has low support. However ysoserial has 22 bugs and it has 3 vulnerabilities. You can download it from GitHub.

new gadget: Click1:

Support

Quality

Security

License

Reuse

Support

ysoserial has a low active ecosystem.

It has 12 star(s) with 4 fork(s). There are 2 watchers for this library.

It had no major release in the last 6 months.

There are 1 open issues and 0 have been closed. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of ysoserial is current.

Quality

ysoserial has 22 bugs (3 blocker, 8 critical, 11 major, 0 minor) and 657 code smells.

Security

ysoserial has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

ysoserial code analysis shows 3 unresolved vulnerabilities (0 blocker, 3 critical, 0 major, 0 minor).

There are 38 security hotspots that need review.

License

ysoserial is licensed under the MIT License. This license is Permissive.

Permissive licenses have the least restrictions, and you can use them in most projects.

Reuse

ysoserial releases are not available. You will need to build from source code and install.

Build file is available. You can build the component from source.

Installation instructions are not available. Examples and code snippets are available.

It has 6169 lines of code, 362 functions and 107 files.

It has low code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi has reviewed ysoserial and discovered the below as its top functions. This is intended to give you an instant insight into ysoserial implemented functionality, and help decide if they suit your requirements.

The main entry point
Open a connection to the given IP address
Supports a JRMP socket
Parses the object ID and prints it
Main entry point
Get a Remote object from a remote object
Waits for a connection
Entry point for testing
Formats a list of strings into a list of lines
Create an Activator object
Gets an object from a command
Create Jetty EtyEcho
Return a priority queue
Execute a command
Execute an object
Get object from registry
Gets the object associated with the given command
Converts a command string into an LDAP object
Retrieves the templates for a given command
Main entry point for the view
Checks if the given entry is a Jetty connection
Returns a HashSet object
Execute a command on the object
Gets the idScriptable object
Executes the interaction model
Returns an object that represents a command

Get all kandi verified functions for this library.

ysoserial Key Features

No Key Features are available at this moment for ysoserial.

ysoserial Examples and Code Snippets

No Code Snippets are available at this moment for ysoserial.

Community Discussions

Trending Discussions on ysoserial

Java Deserialization gadget - Why is this ysoserial payload using reflection to set the TiedMapEntry?

QUESTION

Java Deserialization gadget - Why is this ysoserial payload using reflection to set the TiedMapEntry?

Asked 2021-Jun-22 at 08:33

I started studying Java deserialization gadgets. I started with the famous Apache Common Collections gadget and was looking at @matthias_kaiser's gadget chain.

https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/CommonsCollections6.java#L65-L100

Could someone please explain the following?

Why is the TiedMapEntry set via Java reflection vs just using the HashSet#add() method? For example,
...

ANSWER

Answered 2021-Jun-22 at 08:33

If you add a TiedMapEntry to a HashSet, hashCode() is called which triggers TiedMapEntry.getValue() which calls get() on the LazyMap. This will trigger the Transformers to execute which is not something you want at that point.
Side-effect of 1)
Use a debugger and set a breakpoint on method org.apache.commons.collections.map.LazyMap.get(Object)
By reading the implementation code and debugging with a proper IDE (IDEA, Eclipse)

Source https://stackoverflow.com/questions/68052529

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install ysoserial

You can download it from GitHub.
You can use ysoserial like any standard Java library. Please include the the jar files in your classpath. You can also use any IDE and you can run and debug the ysoserial component as you would do with any other Java program. Best practice is to use a build tool that supports dependency management such as Maven or Gradle. For Maven installation, please refer maven.apache.org. For Gradle installation, please refer gradle.org .

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: