Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

GadgetProbe: Exploiting Deserialization to Brute-Force the Remote Classpath

bishopfox.com | blog | #java | #deserialization | #penetration-testing | #gadget-chain | #tool

Summary

Bishop Fox's GadgetProbe probes Java deserialization endpoints to enumerate classes and library versions on the remote classpath, helping testers build payloads when ysoserial chains fail blind.
Published
Collected

original ↗

Related coverage

  1. RMIScout: Safely and Quickly Brute-Force Java RMI Interfaces for Code Execution (bishopfox.com)
  2. Log4j FilteredObjectInputStream Bypass: Pre-auth RCE via MarshalledObject (github.com)
  3. Power Up Your Pen Tests: Creating Burp Suite Extensions with the New Montoya API (bishopfox.com)
  4. Introducing cyber.dic (bishopfox.com)
  5. Why You Need IDontSpeakSSL in Your Life (bishopfox.com)
  6. Case study: How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years (portswigger.net)

back