Releases · Java-Chains/web-chains

04 Jan 12:03

Ar3h

v1.2.4 Latest

Latest

更新内容：

[功能] 同步更新 Class-Obf v1.3.1 版本 (https://github.com/jar-analyzer/class-obf) @4ra1n
[功能] 同步更新 java-memshell-generator(Jmg) v1.0.9 版本
[功能] 新增 XmlDeSerPayload @unam4
[功能] 新增 OpengaussJdbc 链 @guchangan1
[功能] 支持自定义web登录密码，以及是否关闭鉴权
[优化] java-memshell-generator(Jmg) 优化报错提示；支持自动生成随机字符串参数，用于减少特征

What's new:

[Feature] Synchronized update to Class-Obf v1.3.1 (https://github.com/jar-analyzer/class-obf) @4ra1n
[Feature] Synchronously update java-memshell-generator to version v1.0.9
[Feature] Added XmlDeSerPayload @unam4
[Feature] Added OpengaussJdbc chain @guchangan1
[Feature] Customize web login password, customize whether to disable authentication.
[Optimization] java-memshell-generator (Jmg) optimizes error message prompts; supports automatically generating random string parameters to reduce signatures.

4ra1n, guchangan1, and unam4

Assets 4

11 Dec 14:32

Ar3h

v1.2.3

更新内容：

[功能] 支持字节码混淆，集成 https://github.com/jar-analyzer/class-obf 项目 @4ra1n
[功能] 新增 ExpressionPayload、JDBCPayload，方便生成表达式相关Payload以及JDBC URL相关Payload
[优化] FakeMySQL日志更详细的输出
[BUG] 修复前端展开BUG

What's new:

[Feature] Support for bytecode obfuscation, integrated with the Class-Obf project by @4ra1n
[Feature] Added ExpressionPayload and JDBCPayload for easier generation of expression-related Payloads and JDBC URL-related Payloads
[Improvement] Enhanced FakeMySQL logging with more detailed output
[Bugfix] Fixed front-end expansion issue

4ra1n

Assets 4

07 Dec 08:13

Ar3h

v1.2.2

更新内容：

[功能] 支持国际化，页面支持英文切换，登陆页面后右上角可进行切换语言 @Ar3h
[功能] 新增 OneForAllEcho Gadget，属于字节码类型，可实现Tomcat、WebLogic、Jetty、Spring环境下的一键回显 @4ra1n
[功能] 新增 XMLDecoder Payload 生成 @4ra1n
[新链] 新增 HutoolJndiDSFactory、hutoolSimpleDSFactory、hutoolPooledDSFactory 三条hutools相关Getter链 @unam4
[优化] Java反序列化支持完全 UTF8 Overlong（参考 PPPYSO 项目） @Ar3h
[优化] 优化前端Gadget选项提示，前端使用青色提醒Gadget存在一些不适用的情况，需要阅读详细说明后自行判断 @Ar3h
[优化] 拆分出 DNSLogWithInfo 链，专门用于通过DNSLog回显gadget链信息，方便在梭哈链中进行判断可用链 @Ar3h
[优化] 前端添加缓存，减少请求量，提高速度 @Ar3h
[BUG] 修复 DNSLog、DNSLogAndHttp 无法正常使用的严重BUG

What's new:

[Feature] Support internationalization, the page supports English switching, and the language can be switched in the upper right corner after landing on the page @Ar3h
[Feature] Added 'OneForAllEcho' Gadget, which is a bytecode type, which can realize one-click echo in Tomcat, WebLogic, Jetty, and Spring environments @4ra1n
[Feature] Added 'XMLDecoder' Payload generation @4ra1n
[New Chain] Added three Getter chains: HutoolJndiDSFactory、hutoolSimpleDSFactory、hutoolPooledDSFactory @unam4
[Improve] Java deserialization support for full UTF8 overlong (see PPPYSO project) @Ar3h
[Optimization] Optimized the prompt of the front-end Gadget option, the front-end uses cyan to remind that Gadget is not applicable to some situations, and you need to read the detailed description and make your own judgment @Ar3h
[Improve] Split out the DNSLogWithInfo chain, which is specially used to echo the gadget chain information through DNSLog, which is convenient for judging the available chain in the stud chain @Ar3h
[Improve] Add cache to the front-end to reduce the number of requests and improve the speed @Ar3h
[BUG] Fixed the serious bug that DNSLog and DNSLogAndHttp could not be used normally