Ysomap Versions Save

A helpful Java Deserialization exploit framework.

v0.1.5

5 months ago
  • fix shiro exploit @BBQM1911 #54

v0.1.5 2023.12.04 auto-generated by github actions

v0.1.4

7 months ago

Release v0.1.4, current exploits(28) payloads(43) bullets(45):

  • add 16 exploits
  • add 12 payloads
  • add 9 bullets

Console functions:

  • add yso script support
  • use script /path/to/file.yso to load yso script on cli mode
  • use dump /path/to/file.yso to dump current session's settings on cli mode

Running mode:

  • java -jar ysomap.jar cli to trigger cli mode
  • java -jar ysomap.jar script /path/to/file.yso to trigger script mode

Contributors on v0.1.4

  • @whocansee
  • @Ar3h

v0.1.4 2023.10.15 auto-generated by github actions

v0.1.3

2 years ago

Update:

  • 新增若干payloads、bullets,目前共计 [+] exploits(12) payloads(31) bullets(36)
  • 支持设置编码器、输出方式、serialVersionUid、序列器类型,具体方法见wiki

MD5 (cli/target/ysomap.jar) = d4e72def5bfd8ab1d341a6b71caf16c0

感谢如下小伙伴的提交 XD

  • @orleven
  • @G0doot
  • @BeichenDream
  • @sf197

v0.1.2

2 years ago

add ObjectInputFilter to solve deserialization problem

v0.1.1

2 years ago

v0.1.1 20211122 release [+] exploits(11) payloads(31) bullets(29)

0.0.1-RLEASE

2 years ago

v0.0.1版本:

  1. 支持11种exploits,22种payloads(不包含学习用的gadget),25种bullets
  2. 支持两种运行模式,cli模式和script模式