68891 matches found
WebLogic-Shiro-shell
Java Deserialization Technology Sharing This sharing covers the following points: 1. Java Serialization and Deserialization Basics 2. Why do vulnerabilities occur during deserialization? 3. Java Reflection 4. ysoserial CommonsCollections2, CommonsCollections5 5. Java ClassLoader: Several methods...
x-stream__xstream_CVE-2013-7285_1-4-6
XStream "Java to XML Serialization, and back again" -- Binaries ----------------------------------------------- All binary artifacts are in the 'lib' directory. These include the xstream jars and any other library used at build time, or optional runtime extras. kXML2 is recommend for use as it...
java-cve-2021-29425-tika-xxe
java-cve-2021-29425-tika-xxe...
Krakatau
Krakatau provides an assembler and disassembler for Java bytecode, which allows you to convert binary classfiles to a human readable text format, make changes, and convert it back to a classfile, even for obfuscated code. You can also create your own classfiles from scratch by writing bytecode...
log4j2-vuln-lab
⚠️ Disclaimer : This project is intended for security learning and technical research only. All vulnerability environments are set up locally, and no real targets have been tested. Do not use it for illegal purposes. The risk of using this project is borne by the user. Log4j2 Vulnerability...
yamcs__yamcs_CVE-2023-45277_5-8-6
Yamcs Mission Control Website: https://yamcs.org Mailing list: Google Groups Yamcs is a mission control framework developed in Java. It uses an open-ended architecture that allows tailoring its feature set using yaml configuration files. You can also extend the default feature set by writing cust...
zkar
ZKar ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress , so no complete API document and contribution guide. ZKar provides: A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required From the Java serialization...
hashcat
hashcat hashcat is a highly optimized password recovery platform for GPUs, CPUs, and large distributed systems. Features World's fastest password cracker World's first and only in-kernel rule engine, usable in every attack mode Free and open source, under the MIT license Multi-OS: Linux, Windows...
VulnerableGWTApp
Vulnerable GWT Web Application This is a version of the StockWatcher example application described in the GWT getting-started guide that has been modified to use the GWT "enhanced classes" feature, making it vulnerable to a Java deserialization attack. It should only be used for testing detection...
KubeArmor
KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior such as process execution, file access, and networking operations of pods, containers, and nodes VMs at the system level. KubeArmor leverag...
noise-java
Noise-Java Library Noise-Java is a plain Java implementation of the Noise Protocol, intended as a reference implementation. The code is distributed under the terms of the MIT license. This library is written in plain Java, making use of the Java Cryptography Extension JCE to provide cryptographic...
beanshooter
beanshooter beanshooter is a JMX enumeration and attacking tool, which helps to identify common vulnerabilities on JMX endpoints. https://user-images.githubusercontent.com/49147108/183278179-4a5566a7-5af8-4ce8-a73d-1016876a36d5.mp4 Installation beanshooter is a maven project and installation shou...
POC-CVE-2025-24813-Apache-Tomcat-Remote-Code-Execution
⚠️🚀 CVE-2025-24813 — Apache Tomcat RCE Exploitation Suite ⚡ Version: 1.0 🛡️ CVE ID: CVE-2025-24813 Apache Tomcat RCE 🧬 Payloads: ysoserial / Java 🌐 Mode: Interactive + Stealth 🔬 Usage: Ethical, Investigative, Educational 🌌 Overview This tool has been designed as a futuristic exploitation suite...
weblogic_cve-2019-2890
1）Start the XXER tool python xxer.py -H 192.168.17.223 2）Place the xxer PoC into the xx.xml file, replace the serialized data, and inject the xxer PoC; java -jar weblogicxxe.jar xx.xml 3）Use weblogic.py from the java-deserialization-exploit tool to send data to the Weblogic server python...
BurpSuiteSharpenerEx
Burp Suite Sharpener This extension enhances Burp Suite by adding several UI and functional features, making it more user-friendly. Refer to the "Burp Suite Compatibility and Reporting Errors" section for detailed information on compatibility. / | | . \ | . | || '| . / .| ' |/ .| ' /|||||| |...
CVE-2021-44228
🚨 CVE-2021-44228 — “Log4Shell” A critical remote code execution vulnerability in Apache Log4j 2 , widely known as Log4Shell. 📖 Table of Contents Overview Technical Details Severity & CVSS Affected Versions Exploitation & Impact Real-World Impact Detection Mitigation & Fixes Summary 🔎 Overview...
log4j-rce-test
Build ./build.sh Start log4j RCE Server ./start-log4j-rce-server.sh Test Run java -cp log4j-rce-1.0-SNAPSHOT-all.jar log4j Check if you get logs in hack.log from current folder You can change this line String cmds = "sh", "-c", "echo 'Exploit at '" + getDateString + " ./hack.log" ; in file...
CVE-2026-40473
camel-mina MinaConverter.toObjectInput Unsafe Deserialization Reproducer CVE-2026-40473 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-mina component, tracked as CVE-2026-40473. The MinaConverter.toObjectInputIoBuffer type converter wraps the received bytes...
Liferay-CE-Portal-Java-Deserialization
Liferay-CE-Portal-Java-Deserialization This repo contains PoC for the remote code execution vulnerability of Liferay CE Portal! Payloads I already shared payloads in repo. You must find the right syntax by brute-force method.Payloads I share are for time-based proof of concept sleep 10. The...