ambionics/phpggc
Phpggc
phpggc is a security assessment utility and command-line tool designed for the automated generation, obfuscation, and wrapping of serialized object chains. It functions as a gadget chain framework used to identify and verify remote code execution vectors by testing for PHP object injection vulnerabilities.
The project provides a modular system for constructing complex serialized object sequences and includes a dedicated payload obfuscator to transform byte streams for bypassing web application firewalls and security filters. It also features a generator for wrapping serialized data into archive formats to create polyglot files.
Capabilities include vulnerability analysis through package compatibility auditing and gadget chain filtering. The tool supports payload modification and encoding into various formats, as well as the verification of payload execution within target environments.
Features
- Deserialization Vulnerability Testing - Generates serialized object chains to identify and verify object injection vulnerabilities in PHP applications.
- Deserialization Payloads - Generates maliciously crafted serialized object chains to trigger remote code execution during the PHP deserialization process.
- Deserialization Exploits - Functions as a command-line tool for generating serialized object gadget chains to exploit PHP deserialization flaws.
- Gadget Chain Frameworks - Provides a modular system for constructing and validating complex serialized object sequences used in security research.
- Gadget Chain Construction - Builds complex interconnected object sequences to test how software handles untrusted data during deserialization.
- Gadget Chain Templates - Implements a modular collection of PHP gadget chain templates for constructing reusable exploitation vectors.
- Payload Execution Verification - Verifies that generated gadget chains successfully trigger and execute in the target environment.
- Vulnerability Research - Provides a security assessment utility for identifying and verifying remote code execution vectors in PHP applications.
- Polyglot Archive Wrappers - Wraps serialized byte streams into archive formats like PHAR, TAR, or ZIP to create polyglot files for exploitation.
- Serialized Stream Transformers - Provides utilities for applying character encodings and structural modifications to serialized byte streams to evade security filters.
- Exploitation Archive Generation - Wraps serialized data into archive formats like PHAR, TAR, or ZIP to create polyglot files for exploitation.
- Payload Encoders - Provides utilities to transform serialized data into various encodings to bypass security filters and WAFs.
- Serialization Format Obfuscation - Alters serialization formats by modifying property visibility or number signs to evade detection systems.
- Tamper Pipeline Obfuscators - Provides a modular tamper pipeline for transforming serialized byte streams to bypass web application firewalls.
- PHP Package Vulnerability Analysis - Checks specific versions of PHP libraries and frameworks to determine if they are susceptible to known gadget chains.
- Polyglot Archive Generators - Wraps serialized data into archive formats to create polyglot files for exploitation.
- Version Compatibility Auditing - Tests gadget chains against various package versions to identify which specific versions are vulnerable.
- WAF Bypass Techniques - Implements techniques to obfuscate and transform serialized byte streams to evade Web Application Firewall filters.
- Vulnerability Compatibility Mapping - Matches specific gadget chains against a database of software versions to determine vulnerability viability.
- Web Application Security Assessments - Performs security assessments by sending manipulated serialized payloads to identify remote code execution vulnerabilities.
- Application Security - Library and tool for generating PHP unserialize payloads.
- Deserialization Attacks - Library and generator for PHP unserialize payloads.
- Deserialization Exploits - Tool for generating PHP deserialization payloads.
- Insecure Deserialization - Library and generator for PHP unserialize() payloads.
- Payloads and Shells - Tool for generating PHP generic gadget chains for deserialization attacks.
- Security and Encryption - Generates payloads for testing unserialization vulnerabilities.
- Web Application Analysis - Framework for generating PHP generic gadget chains for deserialization attacks.
- Web Exploitation - Generates payloads for PHP unserialization attacks.
