Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is my implementation of #23, allowing recursively nested payloads.
Changes include:
@Bind private String commandcan be referenced using -command or any unambiguous subset, such as -c.ObjectPayloadhas been modified to add a no-argsgetObject, and the one-arg version has been marked@Deprecated.GeneratePayloadhas also been adjusted to not error on no-arg payloads, such as the SerialDOS payload.@Bindhas a number of configuration options which can be used to filter which types of payloads are allowed and default values. If a default is provided, the -switch will be optional.GeneratePayloadwill now read options prior to the name of the payload, which can be used to adjust output format. For example, to output in ASCII hex format:java -jar ysoserial-whatever-all.jar -hex CommonsCollections1 -command "touch /tmp/hi-guys". Available formats are-hex,-raw, and-base64, as requested in CLI improvements #23.BeanUtilsWrapper1, borrowed from @pwntester's code, demonstrates nested payload generation.I also added two new variants on existing payloads,
CommonsCollections6, which works in JDK8_70+ with a security manager in place (unlike CC5), andCommonsCollectionsGroovy, which will run arbitrary Groovy code in the GroovyShell.Also, POC of #10 coming shortly!