https://github.com/pwntester/xstreamserver

RCE Exploit PoC for Spring based RESTFul APIs using XStream as Unmarshaler
https://github.com/pwntester/xstreamserver

Last synced: 9 months ago
JSON representation

RCE Exploit PoC for Spring based RESTFul APIs using XStream as Unmarshaler

• Host: GitHub
• URL: https://github.com/pwntester/xstreamserver
• Owner: pwntester
• Created: 2013-07-31T08:55:31.000Z (almost 13 years ago)
• Default Branch: master
• Last Pushed: 2013-12-24T14:10:21.000Z (over 12 years ago)
• Last Synced: 2025-02-09T00:02:22.971Z (over 1 year ago)
• Language: Java
• Size: 145 KB
• Stars: 20
• Watchers: 2
• Forks: 5
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

          
XStreamServer

=============

RCE Exploit PoC for Spring based RESTFul APIs using XStream as Unmarshaler

Start the server using the maven jetty plugin:

mvn -Djetty.port=8080 -DDebug clean  jetty:run

Expected use:

curl --header "content-type: application/xml" --data @contact.xml "http://localhost:8080/contacts"

Exploit knowing the interface:

curl --header "content-type: application/xml" --data @exploit.xml "http://localhost:8080/contacts"

Generic Exploit:

curl --header "content-type: application/xml" --data @exploit2.xml "http://localhost:8080/contacts