From 5d8047c43198ac9188c816eaf822a6155b0003c0 Mon Sep 17 00:00:00 2001 From: Paul Johnston Date: Thu, 7 Jun 2018 10:16:07 +0100 Subject: [PATCH 1/2] Introduce manifest, description & gradle --- BappDescription.html | 75 ++++++++++++++++++++++++++++++++++++++++++++ BappManifest.bmf | 12 +++++++ build.gradle | 19 +++++++++++ settings.gradle | 1 + 4 files changed, 107 insertions(+) create mode 100644 BappDescription.html create mode 100644 BappManifest.bmf create mode 100644 build.gradle create mode 100644 settings.gradle diff --git a/BappDescription.html b/BappDescription.html new file mode 100644 index 0000000..5c611e2 --- /dev/null +++ b/BappDescription.html @@ -0,0 +1,75 @@ +

Helps with detecting and exploiting serialization libraries/APIs.

+ +

Based on the work of Alvaro Munoz and Oleksandr Mirosh, + Friday the 13th: JSON Attacks which they presented at Black Hat USA 2017 and Def Con 25. + In their work they reviewed a range of JSON and XML serialization libraries for Java and .NET and found that many of them support serialization of arbitrary runtime objects and + as a result are vulnerable in the same way as many serialization technologies are - snippets of code (POP gadgets) that execute during or soon after deserialization can be + controlled using the properties of the serialized objects, often opening up the potential for arbitrary code or command execution.

+ +

Further modules supporting more formats including YAML and AMF are also included, based on the paper + Java Unmarshaller Security - Turning your data into code execution + and tool marshalsec by Moritz Bechler.

+ +

Freddy Features:

+ + + +

Active scanning attempts to detect the use of vulnerable libraries using three methods:

+ + + +

The following targets are currently supported:

+ +

Java

+ + + +

.NET

+ + diff --git a/BappManifest.bmf b/BappManifest.bmf new file mode 100644 index 0000000..0761369 --- /dev/null +++ b/BappManifest.bmf @@ -0,0 +1,12 @@ +Uuid: ae1cce0c6d6c47528b4af35faebc3ab3 +ExtensionType: 1 +Name: Freddy, Deserialization Bug Finder +RepoName: freddy +ScreenVersion: 2.0 +SerialVersion: 0 +MinPlatformVersion: 0 +ProOnly: True +Author: NCC Group +ShortDescription: Helps detect and exploit deserialization vulnerabilities in Java and .Net +EntryPoint: build/libs/freddy.jar +BuildCommand: gradle jar diff --git a/build.gradle b/build.gradle new file mode 100644 index 0000000..d43c897 --- /dev/null +++ b/build.gradle @@ -0,0 +1,19 @@ +apply plugin: 'java' + +compileJava.options.encoding = 'UTF-8' + +repositories { + mavenCentral() +} + +dependencies { + compile 'net.portswigger.burp.extender:burp-extender-api:1.7.13' +} + +sourceSets { + main { + java { + srcDir 'src' + } + } +} diff --git a/settings.gradle b/settings.gradle new file mode 100644 index 0000000..7f008d0 --- /dev/null +++ b/settings.gradle @@ -0,0 +1 @@ +rootProject.name = 'freddy' From cb7568a30de05531f9266f1a2056fa1101ac236c Mon Sep 17 00:00:00 2001 From: Paul Johnston Date: Mon, 9 Jul 2018 15:31:46 +0100 Subject: [PATCH 2/2] Update description with extra acknowledgement --- BappDescription.html | 2 +- BappManifest.bmf | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/BappDescription.html b/BappDescription.html index 5c611e2..559543d 100644 --- a/BappDescription.html +++ b/BappDescription.html @@ -1,6 +1,6 @@

Helps with detecting and exploiting serialization libraries/APIs.

-

Based on the work of Alvaro Munoz and Oleksandr Mirosh, +

This useful extension was originally developed by Nick Bloor (@nickstadb) for NCC Group and is mainly based on the work of Alvaro Munoz and Oleksandr Mirosh, Friday the 13th: JSON Attacks which they presented at Black Hat USA 2017 and Def Con 25. In their work they reviewed a range of JSON and XML serialization libraries for Java and .NET and found that many of them support serialization of arbitrary runtime objects and as a result are vulnerable in the same way as many serialization technologies are - snippets of code (POP gadgets) that execute during or soon after deserialization can be diff --git a/BappManifest.bmf b/BappManifest.bmf index 0761369..5a03280 100644 --- a/BappManifest.bmf +++ b/BappManifest.bmf @@ -1,9 +1,9 @@ Uuid: ae1cce0c6d6c47528b4af35faebc3ab3 ExtensionType: 1 Name: Freddy, Deserialization Bug Finder -RepoName: freddy +RepoName: freddy-deserialization-bug-finder ScreenVersion: 2.0 -SerialVersion: 0 +SerialVersion: 1 MinPlatformVersion: 0 ProOnly: True Author: NCC Group