148 matches found
ysoserial
ysoserial A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. Description Originally released as part of AppSecCali 2015 Talk "Marshalling Pickles: how deserializing objects will ruin your day" with gadget chains for Apache Commons Collections 3.x and...
zkar
ZKar ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress , so no complete API document and contribution guide. ZKar provides: A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required From the Java serialization...
WLT3Serial
WLT3Serial Exploit di deserializzazione nativo basato su Java per i listener T3 e T3S di WebLogic come descritto QUI. Richiede le dipendenze di terze parti ysoserial e wlthint3client. Vantaggi/Svantaggi rispetto a JavaUnserializeExploits weblogic.py e loubia Vantaggi: Gestisce la comunicazione...
ysoserial
ysoserial Uno strumento proof-of-concept per generare payload che sfruttano la deserializzazione non sicura di oggetti Java. Descrizione Originariamente rilasciato come parte del talk AppSecCali 2015 "Marshalling Pickles: how deserializing objects will ruin your day" con gadget chain per Apache...
GadgetProbe
Description You just found a Java deserialization bug, you ran all your ysoserial payloads, and.... you got nothing. What now? How can you debug or build a gadget chain if you're totally blind? Introducing GadgetProbe, a tool that shines a light on remote classpaths and raises bug severity for al...
ysoserial-modified
ysoserial-modified Das ist ein Fork der ursprünglichen ysoserial-Anwendung, die du hier finden kannst: https://github.com/frohoff/ysoserial Beschreibung der Modifikation Dadurch, wie Runtime.getRuntime.execString.class in Java funktioniert, sind verschachtelte und komplexe Befehle, bei denen du...
Java-Deserialization-Scanner
Java Deserialization Scanner Java Deserialization Scanner è un plugin per Burp Suite progettato per rilevare e sfruttare le vulnerabilità di deserializzazione Java. È stato scritto da Federico Dotta, Principal Security Analyst presso HN Security. Il plugin è composto da tre diversi componenti: 1...
CVE-2026-25551
Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack...
CVE-2026-25551
Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack...
CVE-2026-25551 Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service
Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack...
PT-2026-46298
Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack...
Exploit for Deserialization of Untrusted Data in Vmware Spring_Framework
CVE-2016-1000027-with-c...
Exploit for Deserialization of Untrusted Data in Fortra Goanywhere_Managed_File_Transfer
Structure du projet cve-2023-0669-simulation/ ├── docker-comp...
EUVD-2021-14095
Malware in sbrugna...
Shiro_exploit
This is a Python script for exploiting Apache Shiro vulnerabilities. The script is designed to detect and exploit Shiro's deserialization vulnerability. Here's a breakdown of the script: Importing Libraries The script starts by importing various Python libraries, including os, re, base64, uuid,...
shiro-exploit
This is a Python script for exploiting a vulnerability in Apache Shiro, a Java-based security framework. The script is designed to bypass authentication and authorization checks in Shiro, allowing an attacker to gain unauthorized access to sensitive data. The script uses the Crypto.Cipher module ...
Exploit for Deserialization of Untrusted Data in Apache Tomcat
Tomcat CVE-2025-24813 playground ===============================...
Exploit for Deserialization of Untrusted Data in Apache Tomcat
CVE-2025-24813-PoC === CVE-2025-24813 affects Apache Tomcat - i...