Types & classes — github.com/SugarP1g/LearningSecurity

CodeHub MCPcopy Create free account

hub / github.com/SugarP1g/LearningSecurity / types & classes

Types & classes57 in github.com/SugarP1g/LearningSecurity

⨍ Functions 143◇ Types & classes 57 ↳ Endpoints 6

↓ 3 callersClassGen

src/PythonSecurity/deserialization/poc.py:14

↓ 1 callersClassExp

src/PythonSecurity/deserialization/LearningJsonpickle/poc.py:10

↓ 1 callersClassExp

src/PythonSecurity/deserialization/LearningPickle/vuln.py:8

↓ 1 callersClassExp

src/PythonSecurity/deserialization/LearningPickle/poc.py:8

↓ 1 callersClassPayload

src/PythonSecurity/deserialization/poc.py:22

↓ 1 callersClassexp

src/PythonSecurity/deserialization/LearningShelve/vuln.py:9

docs/CTF/Google CTF 2020/web/PASTEURIZE/source.js:33

ClassBlackListBypass

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/Yaml/ScriptEngineManager/BlackListBypass.java:6

ClassByCreateClassLoader

src/JavaSecurity/LearningSandboxEscape/src/main/java/com/SugarP1g/securityManager/ByCreateClassLoader.java:3

ClassBySetSecurityManager

src/JavaSecurity/LearningSandboxEscape/src/main/java/com/SugarP1g/securityManager/BySetSecurityManager.java:3

ClassCC1Before8u71

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/CommonsCollections/CC1Before8u71.java:20

ClassCVE_2021_21344

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/XStream/CVE_2021_21344.java:12

ClassCVE_2021_29505

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/XStream/CVE_2021_29505.java:10

ClassClassLoaderExpolit

src/JavaSecurity/LearningSandboxEscape/src/main/java/com/SugarP1g/securityManager/ClassLoaderExpolit.java:6

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/jdbc/mysql/client/Client.java:6

src/JavaSecurity/LearningJNDI/src/main/java/com/SugarP1g/ldap/Client.java:8

docs/CTF/Google CTF 2020/web/PASTEURIZE/source.js:33

src/JavaSecurity/LearningDirectoryTraversal/src/main/java/com/SugarP1g/unzip/Demo.java:11

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/CommonsCollections/CommonCollections1/Demo.java:12

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/Urldns/Demo.java:9

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/jdbc/db2/Demo.java:6

src/JavaSecurity/LearningExpressInjection/src/main/java/com/SugarP1g/jexlInject/Demo.java:6

ClassEvilScriptEngine

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/Yaml/ScriptEngineManager/server/EvilScriptEngine.java:6

ClassEvilTemplatesImpl

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/CommonsCollections/CommonsCollections3/PocWithTrAXFilter.java:32

ClassHelloDefineClass

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/reflection/HelloDefineClass.java:6

InterfaceIPerson

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/XStream/IPerson.java:3

ClassLearningTemplatesImpl

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/exploit/LearningTemplatesImpl.java:10

ClassMyClassLoader

src/JavaSecurity/LearningSandboxEscape/src/main/java/com/SugarP1g/securityManager/MyClassLoader.java:13

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/Urldns/POC.java:9

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/XMLDecoder/POC.java:6

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/Yaml/POC.java:5

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/Yaml/ScriptEngineManager/POC.java:5

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/XStream/POC.java:9

src/JavaSecurity/LearningSandboxEscape/src/main/java/com/SugarP1g/nashorn/POC.java:9

src/JavaSecurity/LearningSSTI/src/main/java/com/SugarP1g/ssti/FreeMarker/POC.java:11

src/JavaSecurity/LearningExpressInjection/src/main/java/com/SugarP1g/groovyInjection/POC.java:11

src/JavaSecurity/LearningExpressInjection/src/main/java/com/SugarP1g/spelInjection/POC.java:7

src/JavaSecurity/LearningExpressInjection/src/main/java/com/SugarP1g/felInjection/POC.java:6

src/JavaSecurity/LearningExpressInjection/src/main/java/com/SugarP1g/elInjection/POC.java:9

src/JavaSecurity/LearningExpressInjection/src/main/java/com/SugarP1g/mvelInjection/POC.java:8

src/JavaSecurity/LearningReDoS/src/main/java/com/SugarP1g/ReDoS/POC.java:3

src/JavaSecurity/LearningReDoS/src/main/java/com/SugarP1g/ReDoS/POC2.java:8

ClassPOCWithJdbcRowSetImpl

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/Fastjson/POCWithJdbcRowSetImpl.java:5

ClassPOCWithSandbox

src/JavaSecurity/LearningExpressInjection/src/main/java/com/SugarP1g/jexlInject/POCWithSandbox.java:6

ClassPOCWithoutSandbox

src/JavaSecurity/LearningExpressInjection/src/main/java/com/SugarP1g/jexlInject/POCWithoutSandbox.java:5

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/XStream/Person.java:3

ClassPocWithLazyMap

在Java 8u71以后的版本中该POC无法使用。因为在8u71版本以后，官方修改了AnnotationInvocationHandler类readobject函数实现。不再直接使用反序列化得到的Map对象，而是新建了一个LinkedHashMap对象，并将原来的键值添加进去。本地测试JDK版

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/CommonsCollections/CommonCollections1/PocWithLazyMap.java:27

ClassPocWithTiedMapEntry

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/CommonsCollections/CommonsCollections6/PocWithTiedMapEntry.java:15

ClassPocWithTrAXFilter

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/CommonsCollections/CommonsCollections3/PocWithTrAXFilter.java:46

ClassPocWithTransformedMap

在Java 8u71以后的版本中该POC无法使用。因为在8u71版本以后，官方修改了AnnotationInvocationHandler类readobject函数实现。不再直接使用反序列化得到的Map对象，而是新建了一个LinkedHashMap对象，并将原来的键值添加进去。本地测试JDK版

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/CommonsCollections/CommonCollections1/PocWithTransformedMap.java:38

src/JavaSecurity/LearningSandboxEscape/src/main/java/com/SugarP1g/nashorn/ReDoSPOC.java:9

ClassReflectBypass

src/JavaSecurity/LearningSandboxEscape/src/main/java/com/SugarP1g/securityManager/ReflectBypass.java:6

ClassReflectBypass2

src/JavaSecurity/LearningSandboxEscape/src/main/java/com/SugarP1g/securityManager/ReflectBypass2.java:7

ClassReflection

src/JavaSecurity/LearningRCE/src/main/java/com/SugarP1g/runtime/Reflection.java:6

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/XStream/S2_052.java:10

ClassSilentURLStreamHandler

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/deserialization/Urldns/Demo.java:32

ClassTestRuntime

src/JavaSecurity/LearningDeserialization/src/main/java/com/SugarP1g/reflection/TestRuntime.java:7