CVE-2021-44228-Log4Shell-POC

CVE-2021-44228-Log4Shell-POC Complete POC for Infamous Log4j CVE-2021-44228 Prerequisites Download and Install Java from here, you can use jdk-8u181. Install IntelliJ Idea from here POC Step 1 : Clone this repository. Step 2 : Move Exploit.java file to a different folder. Like in my case I've...

CVE-2021-2394

CVE-2021-2394 POC of CVE-2021-2394 Disclaimer This project is for educational use only. Any direct or indirect consequences and losses caused by unauthorized testing shall be borne solely by the user. Notes The POC uses IIOP to send packets. Please add the relevant dependencies the 12.2.1.3.0...

CVE-2015-7501

Lab for Java Deserialization Vulnerabilities This content is related to the paper written for the 12th edition of H2HC magazine. See full paper in: https://www.h2hc.com.br/revista/ Slides and video of the talk will be available soon. Um overview sobre as bases das falhas de desserialização nativa...

CVE-2026-0848-PoC-Improper-Input-Validation

CVE-2026-0848 - PoC de RCE no NLTK StanfordSegmenter ⚠️ AVISO Este código executa comandos arbitrários no seu sistema. Usar SOMENTE em máquinas virtuais ou contêineres isolados. Descrição PoC funcional para CVE-2026-0848. Demonstra como um arquivo JAR malicioso pode executar código arbitrário...

SpringCloudGatewayRCE

SpringCloudGateway Remote Command Execution Vulnerability Code By: Tas9er 0x00 Risk Overview This tool is intended for authorized security testing only. Unauthorized attacks on systems are prohibited. 0x01 Tool Usage java -jar SpringCloudGatewayRCE.jar 0x02 Bug Issues Will address later...

Log4J_Exploitation-Vulnerabiliy__CVE-2021-44228

Log4JExploitation-VulnérabilitéCVE-2021-44228. introduction Une vulnérabilité d'exécution de code à distance a été découverte dans la bibliothèque de journalisation Java Log4j. CVE-2021-44228 Cette vulnérabilité a provoqué une onde de choc dans la communauté cybernétique mondiale : depuis Wannacr...

CVE-2017-10366_peoplesoft

CVE-2017-10366: Oracle PeopleSoft 8.54, 8.55, 8.56 Java deserialization exploit This script automates the exploitation of a Java deserialization vulnerability in Oracle PeopleSoft, originally discovered by Vahagn Vardanyan. This exploit requires ysoserial.jar to generate cross-platform serialized...

CVE-2018-1000861

CVE-2018-1000861 用于利用CVE-2018-1000861的简单脚本，使用Python 3编写 使用说明： root@kitploit: usage: exploit.py -h -u URL -c CMD -r -i IP -p PORT -v options: -h, --help 显示帮助信息并退出 -u URL, --url URL 目标Jenkins服务器 -c CMD, --cmd CMD 要执行的命令 -r, --revshell 执行反弹shell -i IP, --ip IP 反弹shell回调的IP地址 -p PORT, --port PORT...

CVE-2020-10199_CVE-2020-10204

MaiMeng CVE-2020-10199、CVE-2020-10204 Vulnerability Detection Tool Tool Introduction I wrote this small tool in Java in my spare time. It supports one-click detection of CVE-2020-10199 and CVE-2020-10204 vulnerabilities with a graphical interface. To ensure detection stability, random numbers are...

java-remote-class-loader

Esta ferramenta permite-lhe enviar bytecode Java na forma de ficheiros de classe para os seus clientes ou potenciais alvos para carregar e executar usando Java ClassLoader juntamente com a API Reflect. O cliente recebe o ficheiro de classe do servidor e retorna o respetivo resultado da execução. ...

java-remote-class-loader

This tool allows you to send Java bytecode in the form of class files to your clients or potential targets to load and execute using Java ClassLoader together with Reflect API. The client receives the class file from the server and return the respective execution output. Payloads must be written ...

cve-2021-44228

CVE-2021-44228 Um pacote Zeek que gera notificações, marca conexões HTTP e opcionalmente gera um log para tentativas do Log4J CVE-2021-44228. Detecta payload contido em cabeçalhos HTTP: Consulte Simplifying Detection of Log4Shell para detalhes. Usa assinaturas Zeek para gerar notificações quando ...

srikanth-lingala__zip4j_CVE-2018-1002202_1-3-2

zip4j इस रिपॉजिटरी में CWE-Bench-Java डेटासेट के लिए CVE-2018-1002202 से संबंधित zip4j लाइब्रेरी के संस्करण 1.3.2 असुरक्षित और 1.3.3 सुरक्षित का डिकंपाइल किया गया स्रोत कोड शामिल है। Github पर मूल zip4j रिपॉजिटरी में इन संस्करणों का कोड शामिल नहीं है। संस्करण संस्करण 1.3.2 असुरक्षित टैग : 1.3.2...

ermir

Ermir Ermir ist eine bösartige/Rogue-RMI-Registry, die unsichere Deserialisierung auf jedem Java-Code ausnutzt, der standardmäßige RMI-Methoden darauf aufruft list/lookup/bind/rebind/unbind. Anforderungen Ruby v3 oder neuer. Installation Ermir von rubygems.org installieren: root@kitploit: $ gem...

ermir

Ermir Ermir is an Evil/Rogue RMI Registry, it exploits unsecure deserialization on any Java code calling standard RMI methods on it list/lookup/bind/rebind/unbind. Requirements Ruby v3 or newer. Installation Install Ermir from rubygems.org: root@kitploit: $ gem install ermir or clone the repo and...

rogue-jndi

Rogue JNDI Ein bösartiger LDAP-Server für JNDI-Injection-Angriffe. Beschreibung Das Projekt enthält LDAP- und HTTP-Server zum Ausnutzen der standardmäßig unsicheren Java-JNDI-API. Um einen Angriff durchzuführen, kannst du diese Server lokal starten und dann eine JNDI-Auflösung auf dem verwundbare...

Jboss_JMXInvokerServlet_Deserialization_RCE

JbossJMXInvokerServletDeserializationRCE Usando Burp Suite para explorar a vulnerabilidade de desserialização Java 0x01 Configurando a vulnerabilidade de desserialização do JBoss JMXInvokerServlet Ambiente de teste: Vulnerabilidade de desserialização do JBoss JMXInvokerServlet Princípio da...

CVE-2026-22812-OpenCode-RCE-exp

CVE-2026-22812-OpenCode-RCE-exp Usage: java -jar xxx.jar Recommended environment: jdk8...

CVE-2017-7525-Jackson-Deserialization-Lab

CVE-2017-7525 Java 不安全反序列化实验室 基础 Java REST 应用程序，存在不安全反序列化漏洞，可导致 RCE。 项目必须在 Java 8u45 上运行 基于 Maven，依赖如下： jackson-databind 2.2.2 commons-collections 3.1 spring-context-support 4.3.11 您可以通过 Maven 添加更多依赖，以便尝试其他 gadget。 运行 打开（推荐使用 IntelliJ IDEA）并运行 src/main/java/com/deserialization/lab/Main.java 中的 Ja...

CVE-2025-42944

CVE-2025-42944 SAP NetWeaver में एक डिसीरियलाइज़ेशन भेद्यता के कारण, एक अप्रमाणित हमलावर RMI-P4 मॉड्यूल के माध्यम से सिस्टम का शोषण कर सकता है, जब वह एक खुले पोर्ट पर दुर्भावनापूर्ण पेलोड सबमिट करता है। ऐसे अविश्वसनीय Java ऑब्जेक्ट्स का डिसीरियलाइज़ेशन मनमाने OS कमांड निष्पादन का कारण बन सकता है,...