https://github.com/pwntester/restletxmldecoder
Restlet API consuming XML serialized Java Objects. Vulnerable to XXE and RCE (if third party libraries like GroovyShell are found in the classpath)
https://github.com/pwntester/restletxmldecoder
Last synced: 5 months ago
JSON representation
Restlet API consuming XML serialized Java Objects. Vulnerable to XXE and RCE (if third party libraries like GroovyShell are found in the classpath)
- Host: GitHub
- URL: https://github.com/pwntester/restletxmldecoder
- Owner: pwntester
- Created: 2013-07-31T08:59:17.000Z (almost 13 years ago)
- Default Branch: master
- Last Pushed: 2013-07-31T09:02:26.000Z (almost 13 years ago)
- Last Synced: 2026-01-13T00:52:17.775Z (6 months ago)
- Language: Java
- Size: 5.9 MB
- Stars: 2
- Watchers: 0
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README
Awesome Lists containing this project
README
javac -cp ./lib/org.restlet.jar:./lib/groovy-all-1.8.9.jar *java
1st terminal: java -cp ./lib/org.restlet.jar:./lib/groovy-all-1.8.9.jar:. ServerRestlets
2nd terminal: java -cp ./lib/org.restlet.jar:. ClientRestlet
3rd terminal:
curl -X PUT -u scott:tiger --header "content-type: application/x-java-serialized-object+xml" --data @customer.xml "http://localhost:8182/customer"
curl -X PUT -u scott:tiger --header "content-type: application/x-java-serialized-object+xml" --data @customer-xee.xml "http://localhost:8182/customer"
curl -X PUT -u scott:tiger --header "content-type: application/x-java-serialized-object+xml" --data @customer-rce.xml "http://localhost:8182/customer"