bigsizeme / fastjson-check

fastjson 被动扫描、不出网payload生成

fastjson-check

0.2 beta 中添加 C3P0 和CC链的两种回显 C3P0回显

在@pmiaowu插件上做的修改，原作者用dnslog.cn进行出网检查，但在大型攻防演练（HW）过程中由于前期打点，测试的站点较多dnslog.cn会对IP进行封禁操作 导致插件无法正常检测

1、增加burp内置BurpCollaborator进行出网探测，

2、针对不出网payload总结支持一键生成回显payload(15种)

#release中提供下载

config界面 reapter右键

fastjson-check's Issues

请问是否存在一些兼容问题，信息如图

java.lang.NullPointerException
	at burp.fls.Z(Unknown Source)
	at burp.e6z.getHttpService(Unknown Source)
	at burp.hr9.getHttpService(Unknown Source)
	at burp.BurpExtender$MarkInfoTab.isEnabled(BurpExtender.java:346)
	at burp.h4t.a(Unknown Source)
	at burp.y0.a(Unknown Source)
	at burp.y0.a(Unknown Source)
	at burp.fyq.a(Unknown Source)
	at burp.g5c.b(Unknown Source)
	at burp.y0.addNotify(Unknown Source)
	at java.desktop/java.awt.Container.addImpl(Container.java:1146)
	at java.desktop/javax.swing.JSplitPane.addImpl(JSplitPane.java:1009)
	at java.desktop/java.awt.Container.add(Container.java:997)
	at java.desktop/javax.swing.JSplitPane.setLeftComponent(JSplitPane.java:453)
	at burp.yf.c(Unknown Source)
	at burp.yf.b(Unknown Source)
	at burp.yf.a(Unknown Source)
	at burp.yf.lambda$layoutInitialised$2(Unknown Source)
	at java.desktop/java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:316)
	at java.desktop/java.awt.EventQueue.dispatchEventImpl(EventQueue.java:770)
	at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:721)
	at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:715)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:391)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:85)
	at java.desktop/java.awt.EventQueue.dispatchEvent(EventQueue.java:740)
	at java.desktop/java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:203)
	at java.desktop/java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:124)
	at java.desktop/java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:113)
	at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:109)
	at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101)
	at java.desktop/java.awt.EventDispatchThread.run(EventDispatchThread.java:90)
java.lang.NullPointerException
	at burp.fls.Z(Unknown Source)
	at burp.e6z.getHttpService(Unknown Source)
	at burp.hr9.getHttpService(Unknown Source)
	at burp.BurpExtender$MarkInfoTab.isEnabled(BurpExtender.java:346)
	at burp.h4t.a(Unknown Source)
	at burp.y0.a(Unknown Source)
	at burp.y0.a(Unknown Source)
	at burp.fyq.a(Unknown Source)
	at burp.g5c.b(Unknown Source)
	at burp.y0.addNotify(Unknown Source)
	at java.desktop/java.awt.Container.addImpl(Container.java:1146)
	at java.desktop/javax.swing.JSplitPane.addImpl(JSplitPane.java:1009)
	at java.desktop/java.awt.Container.add(Container.java:997)
	at java.desktop/javax.swing.JSplitPane.setLeftComponent(JSplitPane.java:453)
	at burp.yf.c(Unknown Source)
	at burp.yf.b(Unknown Source)
	at burp.yf.a(Unknown Source)
	at burp.yf.lambda$layoutInitialised$2(Unknown Source)
	at java.desktop/java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:316)
	at java.desktop/java.awt.EventQueue.dispatchEventImpl(EventQueue.java:770)
	at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:721)
	at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:715)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:391)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:85)
	at java.desktop/java.awt.EventQueue.dispatchEvent(EventQueue.java:740)
	at java.desktop/java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:203)
	at java.desktop/java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:124)
	at java.desktop/java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:113)
	at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:109)
	at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101)
	at java.desktop/java.awt.EventDispatchThread.run(EventDispatchThread.java:90)
DBCP_FASTJSON_TOMCATECHO-----------------------

感谢师傅提供的工具

可以加个c3p0不回显方法么

可以参考
https://github.com/depycode/fastjson-c3p0

fastjson scan unknown error

纯内网环境下扫描出现 fastjson scan unknown error 未知错误