ysoserial on JBoss 6.1.0.Final about ysoserial HOT 2 CLOSED

Hello friend, maybe i can help you.

You can't just send the payload in a post. You also need to send the appropriate http headers (like Content-Type, for example).
For exploiting invoker servlets easily, you can use the jexboss tool, like this:
./jexboss.py -u http://your_jboss_server/invoker/JMXInvokerServlet --servlet-unserialize --cmd 'touch /tmp/test.txt'

This will automatically generate the payload of the commons-collection gadget and send it properly to your server (including the necessary http headers). If you omit the --cmd parameter, it will ask for IP and PORT to make a reverse shell connection...

att,

from ysoserial.

This seems to be an issue with product-specific exploitation rather than payload generation so closing this.

from ysoserial.