|
1 | 1 |
|
2 | | -DeserializationHelper can be used to quickly setup YSoSerial, YSoSerial.Net, PHPGGC, and other tools. Using this tool, you will be able to generate Deserialization Payload via web frontend. |
3 | 2 |
|
4 | | -## Prerequisite |
5 | | - |
6 | | -- Windows OS |
7 | | - |
8 | | -## Installation |
| 3 | +It's Web Interface to generate payload using various deserialization exploitation framework |
9 | 4 |
|
| 5 | +## Description |
10 | 6 |
|
11 | | -1. Download the latest relaese from the release tab. |
12 | | -  |
| 7 | +During the pentesting engagement of the application which are built in different programing langauge. In order to exploit the deserialization vulnerability it is require to setup different tools like YSoSerial(Java), YSoSerial.NET, PHPGGC and it's pre-requisite. DeserializationHelper is the web interface which contains the support for YSoSerial(Java), YSoSerial.Net, PHPGGC, and other tools. Using the web interface you can generate the deserialization payload for various framework. |
13 | 8 |
|
14 | | -2. Create the website using IIS Manager. |
| 9 | +## Desclaimer |
15 | 10 |
|
16 | | -  |
| 11 | +This tool is not intended to be used to attack systems except where explicitly authorized. We are not responsible or liable for misuse of the software. Please use it responsibly. |
17 | 12 |
|
18 | | -3. Provide the website information |
19 | | -  |
| 13 | +## Prerequisite |
20 | 14 |
|
| 15 | +- Windows OS |
21 | 16 |
|
22 | | -4. Please check that the following packages are installed in IIS before browsing the application. |
23 | | -  |
| 17 | +## Installation |
24 | 18 |
|
25 | | -5. Browse the application. |
26 | | -  |
| 19 | +- To build the source code |
| 20 | + - Follow the [build guide](Usage/Build.md) |
| 21 | +- To install the latest released version |
| 22 | + - Follow the [deployment guide](Usage/Deployment.md) |
| 23 | +- Web.config Permission Issue |
| 24 | + - Follow the [Permission issue guide](Usage/IIS_Permission.md) |
| 25 | +- Directory Issue |
| 26 | + - Follow the [Directory Listing issue guide](Usage/DirectoryListing.md) |
27 | 27 |
|
28 | | -6. Navigates to the options and generate the payload |
29 | | -  |
30 | | - |
31 | | -## Troubleshooting |
| 28 | +## Usage |
32 | 29 |
|
33 | | -If you face any permission issues as shown below. |
34 | | -  |
| 30 | +Navigate to the link for which you want to generate the payload. For example, In order to generate YSoSerial Deserialization payload then use "YSoSerial" tab as shown below: |
35 | 31 |
|
36 | | -You can fix the permission by following the steps as shown in below screenshot. |
37 | | -  |
| 32 | + |
38 | 33 |
|
39 | 34 | ## References |
40 | 35 |
|
| 36 | +- https://notsosecure.com/remote-code-execution-via-php-unserialize/ |
| 37 | +- https://notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/ |
41 | 38 | - https://github.com/frohoff/ysoserial |
42 | 39 | - https://github.com/pwntester/ysoserial.net |
43 | 40 | - https://github.com/ambionics/phpggc |
|
0 commit comments