Skip to content

v1.2.2

Compare
Choose a tag to compare
@Ar3h Ar3h released this 07 Dec 08:13
· 4 commits to main since this release

更新内容:

  • [功能] 支持国际化,页面支持英文切换,登陆页面后右上角可进行切换语言 @Ar3h
  • [功能] 新增 OneForAllEcho Gadget,属于字节码类型,可实现Tomcat、WebLogic、Jetty、Spring环境下的一键回显 @4ra1n
  • [功能] 新增 XMLDecoder Payload 生成 @4ra1n
  • [新链] 新增 HutoolJndiDSFactory、hutoolSimpleDSFactory、hutoolPooledDSFactory 三条hutools相关Getter链 @unam4
  • [优化] Java反序列化支持完全 UTF8 Overlong(参考 PPPYSO 项目) @Ar3h
  • [优化] 优化前端Gadget选项提示,前端使用青色提醒Gadget存在一些不适用的情况,需要阅读详细说明后自行判断 @Ar3h
  • [优化] 拆分出 DNSLogWithInfo 链,专门用于通过DNSLog回显gadget链信息,方便在梭哈链中进行判断可用链 @Ar3h
  • [优化] 前端添加缓存,减少请求量,提高速度 @Ar3h
  • [BUG] 修复 DNSLog、DNSLogAndHttp 无法正常使用的严重BUG

What's new:

  • [Feature] Support internationalization, the page supports English switching, and the language can be switched in the upper right corner after landing on the page @Ar3h
  • [Feature] Added 'OneForAllEcho' Gadget, which is a bytecode type, which can realize one-click echo in Tomcat, WebLogic, Jetty, and Spring environments @4ra1n
  • [Feature] Added 'XMLDecoder' Payload generation @4ra1n
  • [New Chain] Added three Getter chains: HutoolJndiDSFactory、hutoolSimpleDSFactory、hutoolPooledDSFactory @unam4
  • [Improve] Java deserialization support for full UTF8 overlong (see PPPYSO project) @Ar3h
  • [Optimization] Optimized the prompt of the front-end Gadget option, the front-end uses cyan to remind that Gadget is not applicable to some situations, and you need to read the detailed description and make your own judgment @Ar3h
  • [Improve] Split out the DNSLogWithInfo chain, which is specially used to echo the gadget chain information through DNSLog, which is convenient for judging the available chain in the stud chain @Ar3h
  • [Improve] Add cache to the front-end to reduce the number of requests and improve the speed @Ar3h
  • [BUG] Fixed the serious bug that DNSLog and DNSLogAndHttp could not be used normally

感谢以下用户的贡献:
Thanks to the following users for their contributions: