{"id":13796867,"url":"https://github.com/pwntester/serialkillerbypassgadgetcollection","last_synced_at":"2025-08-15T22:37:40.885Z","repository":{"id":44671515,"uuid":"55979293","full_name":"pwntester/SerialKillerBypassGadgetCollection","owner":"pwntester","description":"Collection of bypass gadgets to extend and wrap ysoserial payloads","archived":false,"fork":false,"pushed_at":"2022-04-16T04:25:03.000Z","size":24,"stargazers_count":351,"open_issues_count":3,"forks_count":76,"subscribers_count":15,"default_branch":"master","last_synced_at":"2025-04-04T11:44:53.309Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pwntester.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-04-11T14:27:50.000Z","updated_at":"2024-12-11T23:28:34.000Z","dependencies_parsed_at":"2022-09-12T15:22:55.451Z","dependency_job_id":null,"html_url":"https://github.com/pwntester/SerialKillerBypassGadgetCollection","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pwntester%2FSerialKillerBypassGadgetCollection","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pwntester%2FSerialKillerBypassGadgetCollection/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pwntester%2FSerialKillerBypassGadgetCollection/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pwntester%2FSerialKillerBypassGadgetCollection/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pwntester","download_url":"https://codeload.github.com/pwntester/SerialKillerBypassGadgetCollection/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247608153,"owners_count":20965952,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T23:01:17.137Z","updated_at":"2025-04-07T07:14:24.177Z","avatar_url":"https://github.com/pwntester.png","language":"Java","funding_links":[],"categories":["\u003ca id=\"8c5a692b5d26527ef346687e047c5c21\"\u003e\u003c/a\u003e收集"],"sub_categories":[],"readme":"# SerialKiller: Bypass Gadget Collection\n\n## Description\n\nCollection of Bypass Gadgets that can be used in JVM Deserialization Gadget chains to bypass [\"Look-Ahead ObjectInputStreams\"](http://www.ibm.com/developerworks/library/se-lookahead/) desfensive deserialization.\n\nReleased as part of RSA 2016 Talk [\"SerialKiller: Silently Pwning Your Java Endpoints\"](https://www.rsaconference.com/events/us16/agenda/sessions/2389/serial-killer-silently-pwning-your-java-endpoints) by Alvaro Muñoz (@pwntester) and Christian Schneider (@cschneider4711).\n\nDetails about bypass gadget technique can be found in the following resources:\n- [\"Paper\"](https://community.microfocus.com/t5/Fortify-User-Discussions/The-perils-of-Java-deserialization/td-p/1596306?attachment-id=63108)\n- [\"Slides\"](https://speakerdeck.com/pwntester/serial-killer-silently-pwning-your-java-endpoints)\n- [\"OWASP BeNeLux Day Slides\"](https://www.owasp.org/images/8/8b/OWASPBNL_Java_Deserialization.pdf)\n\n## Disclaimer\n\nThis software has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intended to be used to attack systems except where explicitly authorized. Project maintainers are not responsible or liable for misuse of the software. Use responsibly.\n\n## Requirements\n\nThe current status of this project heavily depends on [\"YSoSerial\"](https://github.com/frohoff/ysoserial).  project and the idea is to integrate it there in the near future (see below).  It can actually be considered an extension of ysoserial and it reuses some parts of the code and all the payload gadgets in order to facilitate future integration.\n\nCopy the current version (`ysoserial-0.0.5-SNAPSHOT-all.jar`) to `/external` and adjust the `pom.xml` if using a different version.\n\nThe following Jar files are required from Weblogic and WebSphere application servers and not distributed with SerialKiller Bypass Gadget Collection.  Copy them from your authorized version of the application server to the `/external` directory.\n\n```\ncom.ibm.jaxws.thinclient_8.5.0.jar\ncom.ibm.ws.ejb.embeddableContainer_8.5.0.jar\ncom.oracle.weblogic.iiop-common.jar\ncom.ibm.mq.jmqi.jar\ncom.ibm.ws.ejb.thinclient_8.5.0.jar\ncom.ibm.msg.client.jms.jar\ncom.ibm.ws.runtime.coregroupbridge.jar\n```\n\n## Build\n\n`mvn clean compile assembly:single`\n\n## Usage\n\n`java -jar target/serialkiller-bypass-gadgets-0.0.1-SNAPSHOT-all.jar \u003cPayload Gadget, eg: CommonsCollections2\u003e \u003cBypass Gadget, eg: Weblogic1\u003e \u003cCommand, eg: 'touch /tmp/test'\u003e`\n\n## Future\n\nThe idea is to integrate this project into YsoSerial project as soon as it supports wrapping payloads in bypass gadgets and handle missing dependencies.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpwntester%2Fserialkillerbypassgadgetcollection","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpwntester%2Fserialkillerbypassgadgetcollection","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpwntester%2Fserialkillerbypassgadgetcollection/lists"}