Skip to content

Add support to nested objects serializer#13

Open
hdbreaker wants to merge 9 commits intomitsuhiko:masterfrom
hdbreaker:master
Open

Add support to nested objects serializer#13
hdbreaker wants to merge 9 commits intomitsuhiko:masterfrom
hdbreaker:master

Conversation

@hdbreaker
Copy link

This change allow serialize nested objects, and simple objects without need use phpobject hook, but for mantain legacy versions use, i have kept the code of phpobject hook

if isinstance(obj, phpobject):
return b'O' + _serialize(obj.name, True)[1:-1] + _serialize(obj.php_vars, False)[1:]
else:
nested or python object code...

i attach my example code:
POISerializer.zip

@hdbreaker
Copy link
Author

I add some changes more, now the code if able to serialize and unserialize nested objects.
I write this changes couse i need to serializate nasted objects to made a demo of how exploit the security bug of PHP Object Injection
POISerializer.zip

hdbreaker added 6 commits April 14, 2016 17:01
…of PHP session, add suport of nested objects serialization/unzerialization
…of PHP session, add suport of nested objects serialization/unzerialization
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant