shiropoc's People
Forkers
harry1080 kong-f yzddmr6 laowang1026 freefv kikaylee evilashz n1f2c3 vrirus moyuwa naxg yut0u yeshuibo pyking pochubs uyid paladin1412 vvone123 hkylin sry309 pikaqi fanyibo2009 bravery9 k0bee aa506 liao10086 center-sun cleanmgr112 gold1029 rassec omiter asdlei99 ikv163 warren-jace gmwshz gloomywind dawson0x00 weaglew xiangcaojc bbghunter feisec 0neatsec yhblkey kerlingcode dnsmaitreya yuusuke4 diannaofengzi jeromeyoung 5l1v3r1 lehendsec m4ph1nshiropoc's Issues
命令行运行jar报错
师傅可以试试把gcm算法加入其中
师傅可以试试把gcm算法加入其中,最近也见到了好多gcm的站)
jar包命令行无法scan
编译失败
检测某个站出现误报情况
Powered by UnicodeSec
Version 0.0.2
八月 01, 2020 4:31:56 下午 org.apache.http.client.protocol.ResponseProcessCookies processCookies
警告: Invalid cookie header: "Set-Cookie: 8VY9p00ccvVgS=5s7CnSS.ODpwYT_v50JzmQn.x0G6eIvX0a8hwJN_WEumAi_mwmJTdsCMnZzgt1NxHtMXnLqaQe.bUAFr1uZ83Cq; Path=/; expires=Tue, 3
0 Jul 2030 08:32:54 GMT; HttpOnly". Invalid 'expires' attribute: Tue, 30 Jul 2030 08:32:54 GMT
found Shiro Vulnerability, Shiro key wGiHplamyXlVB11UXWol8g==
授权测试某站时,发现返回头里没有rememberMe=deleteMe相关字段并且会默认返回Set-Cookie相关的字段,但是检测出了key,日志如上图,返回头如下图
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 01 Aug 2020 08:31:57 GMT
Content-Type: text/html;charset=utf-8
Connection: keep-alive
Set-Cookie: sid=z0Tscj1n+2962467490-Nd1D_qJ28lD1diGfMbUlBWZ1Bf12So0Zi0wwzMr8UiilkY..vOKPORkhuzylS87u68qiFJTKD37xlQTLdabG_a; Path=/xlplatform; HttpOnly
Content-Language: en-US
Pragma: no-cache
Cache-Control: no-store
Expires: Sat, 01 Aug 2020 08:32:54 GMT
Set-Cookie: 8VY9p00ccvVgS=5s7CnSS.ODpwYT_v50JzmQn.x0G6eIvX0a8hwJN_WEumAi_mwmJTdsCMnZzgt1NxHtMXnLqaQe.bUAFr1uZ83Cq; Path=/; expires=Tue, 30 Jul 2030 08:32:54 GMT; HttpOnly
Busscid: unnet
Content-Length: 26689
错误: 找不到或无法加载主类 CommonsCollections10
λ java -cp shiroPoc-0.5-SNAPSHOT-jar-with-dependencies.jar CommonsCollections10 SpringBootEcho1
错误: 找不到或无法加载主类 CommonsCollections10
原因: java.lang.ClassNotFoundException: CommonsCollections10
exp存在强特征被防火墙拦截
命令执行exp使用了cmd作为HTTP请求头,某些防火墙发现存在这个请求包后会拦截。
key异常
bug
这个要结合其他工具使用吗,没找到那个运行的jar文件
jar包生成POC后请求请求路径和请求方法会被删除,导致400
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.