snakeyaml_cve_poc

snakeyamlcvepoc SnakeYAML-CVE-2022-1471-POC build Either build the jar on your host with mvn clean compile assembly:single Or use docker to build an image with docker build -t snakeyaml . run Run the container with docker run --rm -p8080:8080 snakeyaml or the jar if you built on your host with ja...

zaproxy

Zed Attack Proxy ZAP by Checkmarx는 세계에서 가장 널리 사용되는 웹 애플리케이션 스캐너입니다. 무료이자 오픈 소스입니다. 누구나 기여할 수 있는 커뮤니티 기반 GitHub Top 1000 프로젝트입니다. 애플리케이션을 개발하고 테스트하는 동안 웹 애플리케이션의 보안 취약점을 자동으로 찾는 데 도움을 줍니다. 또한 경험이 풍부한 펜테스터가 수동 보안 테스트를 수행할 때 사용하기에 훌륭한 도구입니다. !https://...

CVE-2020-9496

CVE-2020-9496 - RCE Because the 2 xmlrpc related requets in webtools xmlrpc and ping are not using authentication they are vulnerable to unsafe deserialization. This issue was reported to the security team by Alvaro Munoz [email protected] from the GitHub Security Lab team. This vulnerabilit...

Log4j

1.Create a Sample Vulnerable Application . 2.Start a netcat listner . 3.Run the exploit . 5.Use jdk1.8.020 for better results . Exploit-db - https://www.exploit-db.com/exploits/50592...

JavaDeserialization

Java Deserialization Vulnerability Scanner A Java deserialization vulnerability scanner for vulnerabilities similar to CVE-2017-10271. This project currently contains only one PoC; others have not been organized yet. Installation 1. Install nmap ​ https://nmap.org/download.html Download the...

jadx

JADX jadx - Dex to Java decompiler Command line and GUI tools for producing Java source code from Android Dex and Apk files !WARNING Please note that in most cases jadx can't decompile all 100% of the code, so errors will occur. Check Troubleshooting guide for workarounds. Main features: decompil...

jadx

JADX jadx - Dex to Java 디컴파일러 Android Dex 및 Apk 파일에서 Java 소스 코드를 생성하기 위한 명령줄 및 GUI 도구 !WARNING 대부분의 경우 jadx 가 100% 코드를 디컴파일할 수 없으므로 오류가 발생할 수 있습니다. 해결 방법은 문제 해결 가이드를 확인하세요. 주요 기능: APK, dex, aar, aab 및 zip 파일에서 Dalvik 바이트코드를 Java 코드로 디컴파일 AndroidManifest.xml 및 resources.arsc의 기타 리소스 디코딩...

traccar

Traccar Overview Traccar is an open source GPS tracking system. This repository contains Java-based back-end service. It supports more than 200 GPS protocols and more than 2000 models of GPS tracking devices. Traccar can be used with any major SQL database system. It also provides easy to use RES...

CVE-2026-47864

Spring Integration 's SerializingHttpMessageConverter deserializes incoming HTTP request bodies using a raw java.io.ObjectInputStream with no class filtering. Any request carrying Content-Type: application/x-java-serialized-object whose body resolves to a Serializable type is passed directly to r...

autopsy

Autopsy 4 http://www.sleuthkit.org/ 2016年3月15日 概述 Autopsy 是 The Sleuth Kit 及其他开源数字取证工具的图形界面。 Autopsy 3 是从 Autopsy 2 完全重写而来，使其基于 Java。 Autopsy 4 在 Autopsy 3 的基础上进行了改进，支持多个用户在同一案件上协作。 尽管 Autopsy 被设计为跨平台（Windows、Linux、MacOSX），但当前版本仅在 Windows 上功能完整且经过全面测试。 我们已在 XP、Vista 和 Windows 7 上运行过，未遇到任何问题。...

log4j

💻 -h3x0v3rl0rd- 利用 log4j CVE-2021-44228（TryHackMe Solar 演练） root@kitploit: git clone https://github.com/n3rdh4x0r/log4j.git 1. 运行 log4j.py（这将安装所有必要的应用程序并启动 LDAP 服务器） root@kitploit: ifconfig tun0 python3 log4j.py 10.8.227.251 2. 将攻击者 IP 添加到 Exploit.java 文件中 3. 编译 payload root@kitploit: javac...

JEP290Test

JEP290Test 绕过 JEP290 测试...

perwendel__spark_CVE-2018-9159_2-7-1

Spark - 一个面向 Java 8 的微型 Web 框架 新闻 ：Spark 2.7.0 已发布。请试用它并报告任何 bug。 root@kitploit: com.sparkjava spark-core 2.7.0 重要提示 - 较旧版本的 Spark（低于 2.5.2 的版本）存在一个漏洞。请升级到最新版本。 文档请访问：http://sparkjava.com/documentation 使用问题请使用 带有 “spark-java” 标签的 Stack Overflow Javadoc：http://javadoc.io/doc/com.sparkjava/spark-co...

CVE-2020-6287_RECON-scanner

用于 CVE-2020-6287 RECON 的漏洞评估与失陷指标 IoC 扫描器 RECON（NetWeaver 上的远程可利用代码，Remotely Exploitable Code On NetWeaver）是一个严重影响众多基于 SAP NetWeaver Java 技术栈运行的 SAP 业务和技术应用程序的关键（CVSSv3 10）漏洞。该漏洞由 Onapsis 研究实验室发现，并与 SAP 密切合作，于 2020 年 7 月 14 日开发并发布了补丁。鉴于该问题的严重性，美国 DHS CISA、BSI CERT-Bund 以及其他多个政府机构发布了警报，敦促 SAP...

jlangch__venice_CVE-2022-36007_1-10-16

Venice Venice 是一种受 Clojure 启发的沙盒化 Lisp 方言，具有出色的 Java 互操作性。 概述 Venice 是一种 Lisp 方言，源于对一种安全、沙盒化、通用语言的需求。它与 Lisp 共享代码即数据的理念以及强大的宏系统。 Venice 主要是一种函数式编程语言，专注于不可变的持久化数据结构。 Venice 支持宏、尾递归、动态代码加载、多重方法、协议等众多特性。它具备出色的 Java 互操作性，并提供一个可配置的沙盒，能够防止各种不必要的 JVM 和 Venice 交互。Venice 从设计之初就将沙盒作为一等公民内置其中。 Venice 包含一个拥有...

jetty_9.4.31_CVE-2023-26048

Eclipse Jetty Canonical Repository 这是 Jetty 项目的官方仓库，欢迎随时 fork 并贡献代码！ 想提交补丁或拉取请求？ 请确保你已登记 Eclipse 贡献者协议（ECA）。 eclipse.org/legal/ecafaq 项目描述 Jetty 是一款轻量级、高度可扩展的基于 Java 的 Web 服务器和 Servlet 引擎。 我们的目标是以高吞吐量、低延迟的方式支持 HTTP、HTTP/2 和 WebSocket 等 Web 协议，在提供最大性能的同时，保留多年 Servlet 开发积累的易用性和兼容性。 Jetty 是一款现代的全异步...

infer

Infer Infer is a static analysis tool for Java, C++, Objective-C, and C. Infer is written in OCaml. Installation Read our Getting Started page for details on how to install packaged versions of Infer. To build Infer from source, see INSTALL.md. Contributing See CONTRIBUTING.md. License Infer is...

log4shell-rmi-poc

log4shell-rmi-poc A Proof of Concept of the Log4j vulnerability CVE-2021-44228 over Java-RMI It uses Log4j 2.5.7 from spring-boot-starter-log4j2 Requirements: Tested with Java 8 JDK 1.8.025 and Java 11 JDK 11.0.1 How to run the POC 1. Clone the repo: root@kitploit: git clone...

apkvuln

ApkVuln root@kitploit: \ / \ / \ / \ / \ /\ \ \ \ /|\ \ \ | | | \ | |/ /\ \ / / | | | | | | | / \ | / ' \ V /| || | || . | // \|| |\ / /|||| Con ApkVuln obtendrás los archivos .java de un APK y serán analizados en busca de posibles vulnerabilidades en el código, para ello hará uso de...

Java-springboot-codebase 1.1 - Arbitrary File Read

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized...