SerialKillerBypassGadgetCollection

SerialKiller: коллекция Bypass-гаджетов Описание Набор Bypass-гаджетов, которые можно использовать в цепочках гаджетов десериализации JVM для обхода "Look-Ahead ObjectInputStreams" защитной десериализации. Выпущено в рамках выступления на RSA 2016 "SerialKiller: Silently Pwning Your Java Endpoint...

Fix weblogic JAVA deserialization vulnerability of a variety of methods-vulnerability warning-the black bar safety net

The current oracle is also not in the publicly released weblogic JAVA deserialization vulnerability official patch currently see the repair method is nothing more than two: Use SerialKiller replace the sequence of operation of the ObjectInputStream class; In does not affect the business case, the...