Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support to nested objects serializer #13

Open
wants to merge 9 commits into
base: master
Choose a base branch
from

Conversation

hdbreaker
Copy link

This change allow serialize nested objects, and simple objects without need use phpobject hook, but for mantain legacy versions use, i have kept the code of phpobject hook

if isinstance(obj, phpobject):
return b'O' + _serialize(obj.name, True)[1:-1] + _serialize(obj.php_vars, False)[1:]
else:
nested or python object code...

i attach my example code:
POISerializer.zip

@hdbreaker
Copy link
Author

I add some changes more, now the code if able to serialize and unserialize nested objects.
I write this changes couse i need to serializate nasted objects to made a demo of how exploit the security bug of PHP Object Injection
POISerializer.zip

hdbreaker added 6 commits April 14, 2016 17:01
…of PHP session, add suport of nested objects serialization/unzerialization
…of PHP session, add suport of nested objects serialization/unzerialization
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant