x-stream__xstream_CVE-2020-26217_1-4-14-java77

master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. MXParser is recommend for use as it will greatly improve the...

sqlancer

SQLancer is a tool to automatically test Database Management Systems DBMSs in order to find bugs in their implementation. That is, it finds bugs in the code of the DBMS implementation, rather than in queries written by the user. SQLancer has found hundreds of bugs in mature and widely-known DBMSs...

CVE-2026-34486

CVE-2026-34486 — Apache Tomcat EncryptInterceptor RCE Apache Tomcat Tribes cluster communication module fails to discard messages when EncryptInterceptor decryption fails, allowing unauthenticated attackers to trigger Remote Code Execution via Java deserialization on port 4000. Vulnerability...

snuck

snuck Automatic XSS filter bypass Overview snuck is an automatic tool whose goal is to significantly test a given XSS filter by specializing the injections on the basis of the reflection context. This approach adopts Selenium to drive a web browser in reproducing both the attacker and the victim...

CVE-2026-42779

CVE-2026-42779 — Apache MINA Deserialization Filter Bypass to RCE CVSS 3.1: 9.8 CRITICAL AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-502 Deserialization of Untrusted Data Reporter: Venkatraman Kumar, Securin Advisory: Apache Mailing List Overview Apache MINA versions 2.1.0 through 2.1.11 and 2.2...

Poc_for_CVE-2025-24813

!/usr/bin/env python3 """ .----------------. .----------------. .----------------. | | | | | | | | \ | | | | .' | | | | | | | | | | / .' | | | | '. | | | | | | | | | | | | | | | \ . | | | |/ | | || | | ..' | '----------------' '----------------' '----------------' """ CVE-2025-24813 Vulnerability...

shouganaiyo-loader

shouganaiyo-loader: Forced Entry for Java Agents shouganaiyo-loader is a cross-platform Frida-based Node.js command-line tool that forces Java processes to load a Java/JVMTI agent regardless of whether or not the JVM has disabled the agent attach API. Install $ sudo npm install -g...

CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization

CVE-2026-34486 EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization. Affected: 11.0.19+, 10.1.53+, 9.0.116+. Fixed in: 11.0.21, 10.1.54, 9.0.117. Found and reported by Bartlomiej Dmitruk striga.ai. Writeup:...

androidReverse

Android Reverse A reverse engineering suite that runs entirely on Android. No PC, no ADB, no desktop tools — everything from APK extraction to native binary analysis, editing, and rebuilding happens on-device. MCP Server androidReverse includes a built-in Model Context Protocol server, allowing...

Log4j

1.Create a Sample Vulnerable Application . 2.Start a netcat listner . 3.Run the exploit . 5.Use jdk1.8.020 for better results . Exploit-db - https://www.exploit-db.com/exploits/50592...

perwendel__spark_CVE-2016-9177_2-5-1

Spark - a tiny web framework for Java 8 Spark 2.9.4 is out!! com.sparkjava spark-core 2.9.4 Sponsor the project here https://github.com/sponsors/perwendel For documentation please go to: http://sparkjava.com/documentation For usage questions, please use stack overflow with the “spark-java” tag...

apkx

apkx - Android APK Decompilation for the Lazy A Python wrapper to popular free dex converters and Java decompilers. Extracts Java source code directly from the APK. Useful for experimenting with different converters/decompilers without having to worry about classpath settings and command line arg...

QLinspector

QLinspector Finding Java/C gadget chains with CodeQL. More information in our article Installation Clone the repo $ git clone https://github.com/synacktiv/QLinspector.git Search for gadgets: $ codeql database analyze log4j --format=sarif-latest --output=log4j.sarif --search-path=./QLinspector/...

wrongsecrets

OWASP WrongSecrets !Test minikube script \k8s&vault\https://github.com/OWASP/wrongsecrets/actions/workflows/m...

Log4ShellAuditor

🤖 AUTO AUDIT Isolated demonstration testbed of an autonomous reflexive executor agent Go/Java Русский 🇷🇺 • English 🇬🇧 • 中文 🇨🇳 • Español 🇪🇸 • Deutsch 🇩🇪 • Italiano 🇮🇹 • العربية 🇸🇦 🧭 Overview !NOTE AUTO AUDIT is a software suite demonstrating a 100% autonomous closed loop Sense-Think-Act for...

GadgetProbe

Description You just found a Java deserialization bug, you ran all your ysoserial payloads, and.... you got nothing. What now? How can you debug or build a gadget chain if you're totally blind? Introducing GadgetProbe, a tool that shines a light on remote classpaths and raises bug severity for al...

joern

Joern Query Database "Joern-Scan" This is the central query database for the open-source code analysis platform Joern. It has two purposes: It provides the batteries required to turn Joern into a ready-to-run code scanning tool. Its queries serve as examples useful for those looking to write thei...

metasploit-payloads

metasploit-payloads Appveyor build status: This is a unified repository for different Metasploit Framework payloads, which merges these repositories: C Windows Meterpreter Java and Android Meterpreter and Payloads Python and PHP Meterpreter An alternate cross-platform C Meterpreter, called Mettle...

bradamsa

Bradamsa Bradamsa is a Burp Suite extension for Radamsa, a well-known fuzzer made by the Oulu University Secure Programming Group. Inspired by burp-radamsa, this plugin allows to generate Intruder payloads using Radamsa. Download the latest release from HERE. Mix Burp Suite + Radamsa and you get...

vucsa

Vulnerable Client-Server Application VuCSA Vulnerable client-server application VuCSA is made for learning/presenting how to perform penetration tests of non-http client-server applications. It is written in Java with JavaFX graphical user interface. Currently, the vulnerable application contains...