QLinspector

QLinspector Trouver des chaînes de gadgets Java/C avec CodeQL. Plus d'informations dans notre article Installation Clonez le dépôt root@kitploit: $ git clone https://github.com/synacktiv/QLinspector.git Recherchez des gadgets : root@kitploit: $ codeql database analyze log4j --format=sarif-latest...

CVE-2015-7501

Laboratoire pour les vulnérabilités de désérialisation Java Ce contenu est lié à l'article écrit pour la 12e édition du magazine H2HC. Voir l'article complet sur : https://www.h2hc.com.br/revista/ Les slides et la vidéo de la conférence seront bientôt disponibles. Um overview sobre as bases das...

ysoserial

ysoserial أداة إثبات مفهوم لتوليد حمولات تستغل إلغاء تسلسل الكائنات Java غير الآمن. الوصف صدرت أصلاً كجزء من محاضرة AppSecCali 2015 "Marshalling Pickles: how deserializing objects will ruin your day" مع سلاسل أدوات لـ Apache Commons Collections 3.x و 4.x، Spring Beans/Core 4.x، و Groovy 2.3.x. تم...

CVE-2025-24813

مجموعة أدوات استغلال CVE-2025-24813 هذه أداة استغلال متقدمة وآلية لـ CVE-2025-24813 ، تستهدف خوادم Apache Tomcat المعرضة لثغرة إلغاء تسلسل الجلسة غير الآمنة. 🔍 الميزات مسح متعدد الأهداف من ملف أو عنوان URL واحد --targets / --url اختبار تلقائي لسلاسل الأدوات CommonsCollections1-7, BeanShell, Sprin...

ysoserial

ysoserial Инструмент, созданный для демонстрации концепции proof-of-concept и генерации полезных нагрузок, эксплуатирующих небезопасную десериализацию объектов Java. Описание Первоначально выпущен в рамках доклада на AppSecCali 2015 «Marshalling Pickles: как десериализация объектов испортит вам...

SEOPress < 7.9 - Authentication Bypass

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present. id:...

react2shellexploitvisualized

Visualisation React2Shell CVE-2025-55182 Une visualisation éducative interactive expliquant la vulnérabilité React2Shell - une faille critique d'exécution de code à distance CVSS 10.0 dans les composants serveur React. Ce que c'est Un parcours commenté en 5 étapes qui explique : 1. Le SSR...

heyserial

HEY SERIAL! Auteur : Alyssa Rahman @ramen0x3f Créé le : 2021-10-27 Dernière mise à jour : 2021-12-02 Blog : https://www.mandiant.com/resources/hunting-deserialization-exploits Pour plus de détails sur cet outil et le processus de recherche qui le sous-tend, consultez notre blog ! Description Crée...

GadgetProbe

설명 방금 Java 역직렬화 버그를 발견했고, 모든 ysoserial 페이로드를 실행했는데.... 아무것도 나오지 않았나요? 이제 어떻게 해야 할까요? 완전히 눈이 먼 상태에서 가젯 체인을 디버깅하거나 어떻게 구축할 수 있을까요? 원격 클래스패스에 빛을 비추고 모든 이들의 버그 심각도를 높여주는 도구, GadgetProbe를 소개합니다! GadgetProbe는 Java 클래스 워드리스트를 받아 직렬화된 DNS 콜백 객체를 출력하고, 원격 클래스패스에 숨어 있는 것이 무엇인지 보고합니다. Burp 확장 프로그램 사용법 Burp ...

phpggc

PHPGGC : Chaînes de gadgets génériques PHP PHPGGC est une bibliothèque de payloads unserialize accompagnée d'un outil pour les générer, depuis la ligne de commande ou par programmation. Lorsque vous rencontrez un unserialize sur un site dont vous n'avez pas le code, ou simplement lorsque vous...

CVE-2021-3129

CVE-2021-3129 Laravel = v8.4.2 وضع التصحيح: تنفيذ تعليمات برمجية عن بعد CVE-2021-3129 تم تعديل أداة الأستاذ @crisprss على https://github.com/crisprss/LaravelCVE-2021-3129EXP وإضافة المزيد من الأدوات gadgets المتاحة للتجول traversal. الاستخدام: root@kitploit: python3 exp.py http://127.0.0.1:8888...

ysoserial.net

A proof-of-concept tool for generating payloads that exploit unsafe .NET object deserialization. Description ysoserial.net is a collection of utilities and property-oriented programming "gadget chains" discovered in common .NET libraries that can, under the right conditions, exploit .NET...

ysoserial.net

أداة إثبات مفهوم لتوليد حمولات تستغل إلغاء تسلسل الكائنات غير الآمن في .NET. الوصف ysoserial.net عبارة عن مجموعة من الأدوات وسلاسل الأدوات الموجهة للخصائص "gadget chains" المكتشفة في مكتبات .NET الشائعة والتي يمكنها، في ظل الظروف المناسبة، استغلال تطبيقات .NET التي تقوم بإلغاء تسلسل غير آمن...

CVE-2026-55220

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...

PT-2026-70089

Name of the Vulnerable Software and Affected Versions JBoss marshalling affected versions not specified Description A flaw exists in the Infinispan session replication path where replicated session data is deserialized using the JBoss Marshalling River unmarshaller without class filtering. This...

CVE-2026-71294 Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via trim-only sanitization is passed to with no restriction, reachable by any member with wri...

EUVD-2026-52894

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...

CVE-2026-70554

CVE-2026-70554 affects MaxSite CMS. It describes an unauthenticated PHP object injection via the maxsite_comuser cookie, where unvalidated serialized data is passed directly to unserialize(), allowing an attacker to reconstruct object graphs and trigger magic methods. This can enable property-ori...

CVE-2026-55223

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection match the getXXX form, so JavaBean...

EUVD-2026-40388

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including...