Update java-XMLDecoder-RCE.md

2018-05-02 11:39:24 +02:00 · 2018-05-02 11:39:24 +02:00 · 3a2968f8da
parent 8c23453c9f
commit 3a2968f8da
1 changed files with 4 additions and 0 deletions
--- a/web/java-XMLDecoder-RCE.md
+++ b/web/java-XMLDecoder-RCE.md
@ -78,3 +78,7 @@ Then the payload would look like:
  </void>
 </java>
 ```
+
+For more payloads and guides how to leverage **XMLDecoder** deserialization vulnerability, one can refer to following good quality sources:
+- http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
+- https://github.com/o2platform/DefCon_RESTing/tree/master/Demos/_O2_Scripts/XmlEncoder%20-%20Restlet/exploits