ShiroScan

Shiro<=1.2.4 deserialization, one-click detection tool

改动内容：1.新增4个利用链模块(CommonsCollections7-10)，预计增加成功率30%，已打包成新ysoserial的jar包，请勿更换
改动内容：2.增加多线程，虽模块增加但速度却提高300%

集成21个key进行fuzz

• If it helps, please give a star. Corresponding blog article: http://www.svenbeast.com/post/tskRKJIPg/

• pip3 install -r requirments.txt

• Usage: python3 shiro.py url command

• Usage: python3 shiro.py https://url.com whoami

• http://www.dnslog.cn/ It is recommended to use this dnslog platform for verification; it is much faster than ceye.io

• If the command to be executed contains spaces, remember to enclose it in quotes

• usage: python3 shiro.py http://url.com "ping dnslog.cn"

• Run all 11 modules once, then check the dnslog platform to see if a request was received. If nothing appears, GG; it may also be that there are not enough encodings.

• Please collect encodings yourself; you can add methods directly to the source code under moule.

• To keep script execution simple, the number of threads is not controlled by user-passed parameters; the default is 20 threads. If you need to change it, go to line 20 in /moule/main.py and modify the thread control parameters yourself.

Not recommended for use as an exploit; efficiency issue.

For security personnel only to verify/test whether this vulnerability exists.