{"action":"created","issue":{"url":"https://api.github.com/repos/frohoff/ysoserial/issues/5","repository_url":"https://api.github.com/repos/frohoff/ysoserial","labels_url":"https://api.github.com/repos/frohoff/ysoserial/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/frohoff/ysoserial/issues/5/comments","events_url":"https://api.github.com/repos/frohoff/ysoserial/issues/5/events","html_url":"https://github.com/frohoff/ysoserial/pull/5","id":121751996,"number":5,"title":"Added native sleep payloads","user":{"login":"federicodotta","id":1651767,"avatar_url":"https://avatars.githubusercontent.com/u/1651767?v=3","gravatar_id":"","url":"https://api.github.com/users/federicodotta","html_url":"https://github.com/federicodotta","followers_url":"https://api.github.com/users/federicodotta/followers","following_url":"https://api.github.com/users/federicodotta/following{/other_user}","gists_url":"https://api.github.com/users/federicodotta/gists{/gist_id}","starred_url":"https://api.github.com/users/federicodotta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/federicodotta/subscriptions","organizations_url":"https://api.github.com/users/federicodotta/orgs","repos_url":"https://api.github.com/users/federicodotta/repos","events_url":"https://api.github.com/users/federicodotta/events{/privacy}","received_events_url":"https://api.github.com/users/federicodotta/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-12-11T17:08:29Z","updated_at":"2016-03-07T19:18:54Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/frohoff/ysoserial/pulls/5","html_url":"https://github.com/frohoff/ysoserial/pull/5","diff_url":"https://github.com/frohoff/ysoserial/pull/5.diff","patch_url":"https://github.com/frohoff/ysoserial/pull/5.patch"},"body":"Added native sleep payloads to payload generation and RMI exploit"},"comment":{"url":"https://api.github.com/repos/frohoff/ysoserial/issues/comments/193404739","html_url":"https://github.com/frohoff/ysoserial/pull/5#issuecomment-193404739","issue_url":"https://api.github.com/repos/frohoff/ysoserial/issues/5","id":193404739,"user":{"login":"frohoff","id":6477,"avatar_url":"https://avatars.githubusercontent.com/u/6477?v=3","gravatar_id":"","url":"https://api.github.com/users/frohoff","html_url":"https://github.com/frohoff","followers_url":"https://api.github.com/users/frohoff/followers","following_url":"https://api.github.com/users/frohoff/following{/other_user}","gists_url":"https://api.github.com/users/frohoff/gists{/gist_id}","starred_url":"https://api.github.com/users/frohoff/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/frohoff/subscriptions","organizations_url":"https://api.github.com/users/frohoff/orgs","repos_url":"https://api.github.com/users/frohoff/repos","events_url":"https://api.github.com/users/frohoff/events{/privacy}","received_events_url":"https://api.github.com/users/frohoff/received_events","type":"User","site_admin":false},"created_at":"2016-03-07T19:18:53Z","updated_at":"2016-03-07T19:18:53Z","body":"I'm still leaning away from trying to do any gadget/chain-specific detection methods as they really are a poor quality indicator of vulnerability, and this concept will not scale very well as more gadgets are found (counting open PRs, we're up to ~20 gadgets).\r\n\r\nI agree with the advice given by @pwntester and @cschneider4711 in their recent talk for stuff like this:\r\nhttps://www.rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf\r\n\r\n> Recommendation: Adjust active scanning payloads to not rely on specific gadgets - better use a generic delay introduction such as \"SerialDoS\" (by Wouter Coekaerts), which is only HashSet based.\r\n\r\nI will probably close this, but regardless, thanks for the contributions and thoughtful discussion, and please keep educating people about the perils of unsafe deserialization."}}