frohoff / frohoff/ysoserial

Automated generation of object-graph and call-tree documentation

Open
#11 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
9.1k
Forks
1.9k
PR merge metrics
No merged PRs in 30d

Description

To facilitate easier studying of these types of vulnerabilities the tool scaffolding should be able to instrument itself to generate ASCII diagrams of payload object-graphs (similar to [this](https://gist.github.com/frohoff/24af7913611f8406eaf3#deserialized-object-graph-approximate)) and deserialization code execution call-trees (similar to [this](https://gist.github.com/frohoff/24af7913611f8406eaf3#deserialization-call-tree-approximate)) to understand the mechanics of each gadget chain better. Simply providing a list of gadget classes could be useful, and a more sophisticated implementation could embed and/or link to code/methods executed during deserialization.

Optionally allow such documentation to be printed to the console as verbose-mode help text when using the CLI interface.

`PrintUtil` from #16 is probably a good start for object graph inspection

Instrumentation stuff:
- https://github.com/antonarhipov/attach-and-transform-with-mbeans
- https://gist.github.com/nickman/6494990
- http://stackoverflow.com/questions/18567552/how-to-retransform-a-class-at-runtime
- https://github.com/google/allocation-instrumenter

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.