JNDIExploit 一款用于 JNDI注入 利用的工具，大量参考/引用了 Rogue JNDI 项目的代码，支持直接植入内存shell，并集成了常见的bypass 高版本JDK的方式，适用于与自动化工具配合使用。 使用说明 使用 java -jar JNDIExploit.jar -h 查看参数说明，其中 --ip 参数为必选参数 Usage: java -jar JNDIExploit.jar [options] Options: * -i, --ip Local ip address -l, --ldapPort Ldap bind port (default: 1389) -p, --httpPort Http bind port (default: 8080) -u, --usage Show usage (default: false) -h, --help Show thi
To folks wondering what the issue is about, I'll give a short summary that I myself needed.Typically a logging library has one job to do: swallow the string as if it's some black box and spit it elsewhere as per provided configurations. Log4j though, doesn't treat strings as black boxes. It inspects its contents and checks if it contains any "variables" that need to be resolved before spitting out
A JOURNEY FROM JNDI/LDAP MANIPULATION TO REMOTE CODE EXECUTION DREAM LAND Alvaro Muñoz (@pwntester) Oleksandr Mirosh Who are we • Alvaro Muñoz (@pwntester) • Principal Security Researcher, HPE Fortify • Oleksandr Mirosh • Senior QA Engineer, HPE Fortify Agenda • Introduction to JNDI • JNDI Injection • RMI Vector • Demo: EclipseLink/TopLink • CORBA Vector • LDAP Vector • LDAP Entry Poisoning • Demo
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
処理を実行中です
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く