CVE-2020-5245

CVE-2020-5245 1. Run mvn clean install to build your application 2. Start application with java -jar target/dropwizard-1.0-SNAPSHOT.jar server config.yml 3. To check that your application is running enter url http://localhost:8080 some error in pom.xml plugins were not affected reproduce Reproduc...

CVE-2020-1938

CVE-2020-1938 CVE-2020-1938 Vulnerability Reproduction Exploit script: https://laolisafe.com/thread-612-1-1.html Environment: apache-tomcat-8.5.32 java powershell exploit environment - python Start Tomcat sh ./startup.sh Exploit The tool is only for security research and internal self-inspection...

zkar

ZKar ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress , so no complete API document and contribution guide. ZKar provides: A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required From the Java serialization...

CVE-2021-26295-Apache-OFBiz

CVE-2021-26295-Apache-OFBiz CVE-2021-26295 Apache OFBiz RMI deserialization POC You need to place ysoserial.jar in the directory, and you cannot use a high version of Java...

androidReverse

Android Reverse A reverse engineering suite that runs entirely on Android. No PC, no ADB, no desktop tools — everything from APK extraction to native binary analysis, editing, and rebuilding happens on-device. MCP Server androidReverse includes a built-in Model Context Protocol server, allowing...

ParrotNG

ParrotNG ParrotNG is a tool capable of identifying Adobe Flex applications SWF vulnerable to CVE-2011-2461. For more details, please refer to the slides of our Troopers 2015 talk. Download the latest release from HERE. Features Written in Java, based on swfdump One JAR, two flavors: command line...

OnionHarvester

OnionHarvester V2 A small TOR Onion Address harvester for checking if the address is available or not. The program uses the TOR local socks5 proxy for finding all the Onion Addresses which are alive and ports 80 and 443 are available. Details about the project and TOR onion harvesting is publishe...

ff4j__ff4j_CVE-2022-44262_1_8_13_fixed

✨✨✨ FF4J - Feature Flipping for Java ✨✨✨ Codacy Badge FF4j, is an implementation of the Feature Toggle pattern. 🤘Features Feature Toggle: Enable. and disable features at runtime - no deployments. In your code implement multiple paths protected by dynamic predicates if/then/else. Role-based...

autopsy

Autopsy 4 http://www.sleuthkit.org/ March 15, 2016 OVERVIEW Autopsy is a graphical interface to The Sleuth Kit and other open source digital forensics tools. Autopsy 3 was a complete rewrite from Autopsy 2 to make it Java-based. Autopsy 4 improves on Autopsy 3 by supporting collaboration on a...

fernflower

fernflower Quickly decompile class files in the terminal Usage: Usage: java -jar fernflower.jar -= + Example: java -jar fernflower.jar -dgs=true c:\my\source\ c:\my.jar d:\decompiled\ Ps: No more need for jd-gui, it is more powerful than jd-gui...

ddc

ddc — DEX → Java decompiler in Rust English | 简体中文 ddc decompiles Android DEX bytecode back into readable Java — at real-world app scale, queryable like a database, and javac-verified : every one of the 909,689 files it emits across seven real-world APKs parses cleanly. Highlights Fast — a 226 MB...

java-remote-class-loader

This tool allows you to send Java bytecode in the form of class files to your clients or potential targets to load and execute using Java ClassLoader together with Reflect API. The client receives the class file from the server and return the respective execution output. Payloads must be written ...

Argus-SAF

Argus-SAF: Argus static analysis framework This is official reporitory for the Argus-SAF. For test and play with Argus-SAF, you can fork from our Argus-SAF-playground project, which have the basic setup for a Argus-SAF enhanced project with demo codes of how to perform different kind of analysis...

CVE-2025-0054

CVE-2025-0054 – SAP NetWeaver Stored XSS Scanner 🕷 A lightweight Python tool to detect stored Cross-Site Scripting XSS vulnerabilities in SAP NetWeaver Application Server Java , specifically targeting CVE-2025-0054. ⚠️ For educational and authorized security testing only. Do not use on systems...

log4j_checker_beta

log4jcheckerbeta - Linux, macOS and Windows Scripts If you want to use the windows/linux download cradles below, please review the scripts beforehand. Loading code from the internet and execute it is what brought us here with Log4Shell - right? ;- Linux and macOS servers or clients The...

QLinspector

QLinspector Finding Java/C gadget chains with CodeQL. More information in our article Installation Clone the repo $ git clone https://github.com/synacktiv/QLinspector.git Search for gadgets: $ codeql database analyze log4j --format=sarif-latest --output=log4j.sarif --search-path=./QLinspector/...

apache-struts-cve-2017-9805

The Apache Struts web framework The Apache Struts web framework is a free open-source solution for creating Java web applications. Web applications differ from conventional websites in that web applications can create a dynamic response. Many websites deliver only static pages. A web application...

CVE-2020-14750

CVE-2020-14750 PoC for vulnerabilities CVE-2020-14750 and cve-2020-14882 To test if a system is vulnerable use: ./test-CVE-2020-14750 hostname:7001 At the moment, in this version, it only guarantees if the host is vulnerable. If the result is negative, it is not a guarantee that it is not...

Krakatau

Krakatau provides an assembler and disassembler for Java bytecode, which allows you to convert binary classfiles to a human readable text format, make changes, and convert it back to a classfile, even for obfuscated code. You can also create your own classfiles from scratch by writing bytecode...

Ratpack-1

What is Ratpack? Ratpack is a simple, capable, toolkit for creating high performance web applications. Ratpack is built on Java and the Netty event-driven networking engine. The API is optimized for Groovy and Java 8. Optional Google Guice integration provides a foundation for scaling your...