OAUTHScan

OAUTHScan Description OAUTHScan is a Burp Suite Extension written in Java with the aim to provide some automatic security checks, which could be useful during penetration testing on applications implementing OAUTHv2 and OpenID standards. The plugin looks for various OAUTHv2/OpenID vulnerabilities...

owasp-java-encoder

OWASP Java Encoder Contextual output encoding for Java 8+. Choose an encoder for the parser context receiving untrusted text: HTML, JavaScript, CSS, XML or a URL component. The core has no runtime dependencies; optional JSP and Jakarta adapters provide view-layer bindings. Encoding is one part of...

CVE-2022-33980-POC

CVE-2022-33980 $script:js:java.lang.Runtime.getRuntime.exec"calc"...

androidReverse

Android Reverse A reverse engineering suite that runs entirely on Android. No PC, no ADB, no desktop tools — everything from APK extraction to native binary analysis, editing, and rebuilding happens on-device. MCP Server androidReverse includes a built-in Model Context Protocol server, allowing...

alibaba__one-java-agent_CVE-2022-25842_0-0-1

one-java-agent Goals 1. Provide plugin support to centrally manage multiple Java Agents. 2. Plugins support install/uninstall, requiring the plugin to implement interfaces. 3. Support traditional Java agents, i.e., already developed Java agents. Plugin System If a plugin wishes to be aware of the...

CVE-2020-5902

CVE-2020-5902 / \ \ / / | | \ / \ \ / \ | / \ / \ \ | | \ \ / /| | | | | | | | | || || | | | | | | | \ / / | |/ /| | | |/ /| | | || \, | | | |/ / | | \ / | | / /| || / /| || | | / /| || / / | / || ||/|/ |/ // /| CVE-2020-5902-Scanner.py @nsflabs The F5 BIG-IP Traffic Management User...

frida

Frida Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Learn more at frida.re. Two ways to install 1. Install from prebuilt binaries This is the recommended way to get started. All you need to do is: pip install frida-tools CLI tools pip install frida...

falco

Falco Falco is a cloud native runtime security tool for Linux operating systems. It is designed to detect and alert on abnormal behavior and potential security threats in real-time. At its core, Falco is a kernel monitoring and detection agent that observes events, such as syscalls, based on cust...

ddc

ddc — DEX → Java decompiler in Rust English | 简体中文 ddc decompiles Android DEX bytecode back into readable Java — at real-world app scale, queryable like a database, and quality-first : output is checked with javac's parse gate and a full Android classpath, and every file is simplified by an exact...

custom-bytecode-analyzer

custom-bytecode-analyzer Java bytecode analyzer customizable via JSON rules. It is a command-line tool that receives a path containing one or more Jar or War files, analyzes them using the provided rules and generates HTML reports with the results. Usage usage: java -jar cba-cli.jar OPTIONS -a...

CVE-2024-21683-RCE

CVE-2024-21683-RCE Credit https://x.com/realalphaman https://realalphaman.substack.com/p/quick-note-about-cve-2024-21683-authenticated Usage git clone https://github.com/W01fh4cker/CVE-2024-21683-RCE cd CVE-2024-21683-RCE pip install requests bs4 python CVE-2024-21683.py -u...

CVE-2021-26295-Apache-OFBiz

CVE-2021-26295-Apache-OFBiz CVE-2021-26295 Apache OFBiz RMI deserialization POC You need to place ysoserial.jar in the directory, and you cannot use a high version of Java...

zkar

ZKar ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress , so no complete API document and contribution guide. ZKar provides: A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required From the Java serialization...

CVE-2020-26217

Description XStream can be used for Remote Code Execution Influence Xstream com.thoughtworks.xstream xstream 1.4.13 How to use 0 text/plain 0 -1 1 cmd...

log4j2-vuln-lab

⚠️ Disclaimer : This project is intended for security learning and technical research only. All vulnerability environments are set up locally, and no real targets have been tested. Do not use it for illegal purposes. The risk of using this project is borne by the user. Log4j2 Vulnerability...

codeql-workshop-cve-2021-21380

CodeQL workshop for Java: Finding a SQL injection In this workshop we will use syntactical and semantic reasoning to find a SQL injection in the XWiki platform's rating component documented by CVE-2021-21380 Contents CodeQL workshop for Java: Finding a SQL injection Contents Prerequisites and set...

PortEx

PortEx Welcome to PortEx PortEx is a Java library for static malware analysis of Portable Executable files. Its focus is on PE malformation robustness, and anomaly detection. PortEx is written in Java and Scala, and targeted at Java applications. Features Reading header information from: MSDOS...

Bughound

What is Bughound? Bughound is an open-source static code analysis tool that analyzes your code and sends the results to Elasticsearch and Kibana to get useful insights about the potential vulnerabilities in your code. Bughound has its own Elasticsearch and Kibana Docker image that is preconfigure...

java-html-sanitizer

OWASP Java HTML Sanitizer A fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS. The sanitizer JAR has no runtime dependencies. Its only compile-time dependency is spotbugs-annotations...

CVE-2023-51518

CVE-2023-51518: Preauthenticated Java Deserialization via JMX in Apache James Apache James distribution prior to release 3.7.5 and 3.8.1 allow privilege escalation via JMX pre-authentication deserialization. Given a deserialization gadget, this could be leveraged as part of an exploit chain that...