needed payload for the vulnerability about java-deserialization-scanner HOT 1 CLOSED

Hi @mohitmkb,

it should be the CommonsCollections5 payload of ysoserial.

You cannot generate the same payload using frohoff ysoserial because it generates only exec payload for the exploitation. I modified the code to generate sleep and DNS payloads for the detection.

If you need to generate the same payload you can use my ysoserial fork. With this fork you can generate the 10 seconds sleep used for Java Deserialization Scanner as follows:

java -jar ysoserial-fd-0.0.6.jar CommonsCollections5 10000 sleep

It you need to encode the payload, the fork supports also encoding. For example, Base64 + URL:

java -jar ysoserial-fd-0.0.6.jar CommonsCollections5 10000 sleep base64,url_encoding

Federico

from java-deserialization-scanner.