log4shell-vulnerable-app

Aplicación vulnerable Este repositorio contiene una aplicación web Spring Boot vulnerable a CVE-2021-44228, conocida como log4shell. Usa log-4j-core:2.14.1 a través de spring-boot-starter-log4j2 y openjdk:8u181 Ejecutando la aplicación Ejecútalo: root@kitploit: docker run --name vulnerable-app --...

splinter

splinter splinter 是一个 JVM 分析工具包，允许用户在运行时查看类、方法、字段、常量池和字节码。该工具在 OpenJDK 构建 22.0.2+9-70 上开发和测试。 splinter 是什么？ 通常，当你想到 JVM 的分析工具包时，你会认为它使用 JNI 或 JVMTI，但 splinter 不是！ splinter 实际上是外部工具，目前具备以下能力： 可以从正在运行的进程中读取 HotSpot VMStructs 可以通过 Method 和 ConstMethod 实时解码字节码 其长期目标是成为运行时 JVM 分析工具包，用于： 已加载类检查 方法和字段检查...

CVE-2022-34169

Descripción Comprueba si CVE-2022-34169 está corregido en tu máquina. Hasta donde sé, un empleado de Google encontró un exploit y no fue publicado. Dado que la corrección es conocida, se escribió una pequeña rutina de prueba para verificar si la corrección está disponible en tiempo de ejecución...

java-remote-class-loader

This tool allows you to send Java bytecode in the form of class files to your clients or potential targets to load and execute using Java ClassLoader together with Reflect API. The client receives the class file from the server and return the respective execution output. Payloads must be written ...

CVE-2023-46604

CVE-2023-46604 por Ruben Fobe & Klaas Stessens Introducción ADVERTENCIA Este proyecto está destinado únicamente a fines educativos y de laboratorio. Solo utiliza estas técnicas en entornos que te pertenezcan o para los que estés autorizado a realizar pruebas. Este laboratorio simulará la...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

semgrep-rules

semgrep-rules "The attack surface is the vulnerability. Finding a bug there is just a detail." -- Mark Dowd "Some details are more important than others." -- Fedor G. Pikus A collection of my Semgrep rules to facilitate vulnerability research. Blog posts...

kaiju

CERT Kaiju Binary Analysis Framework for GHIDRA CERT Kaiju is a collection of binary analysis tools for Ghidra. This is a Ghidra/Java implementation of some features of the CERT Pharos Binary Analysis Framework, particularly the function hashing and malware analysis tools, but is expected to grow...

CVE-2025-24813

Probando cualquier versión de Tomcat para ver si esa versión es vulnerable a CVE-2025-24813 Este POC permite probar cualquier versión de Tomcat para verificar si esa versión es vulnerable a CVE-2025-24813 bajo las condiciones vulnerables, en entornos Unix probado en una máquina Ubuntu. Nota:...

Security update for java-21-openjdk

This update for java-21-openjdk fixes the following issues: Security issues fixed: CVE-2026-60589: OpenJDK: Improve Resource Resolving bsc1275777. CVE-2026-61308: OpenJDK: Enhance HTTP Connections bsc1275778. CVE-2026-70907: OpenJDK: Enhance TLS server bsc1275764. Non security issue fixed:...

Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20.1+1 August 2026 CSPU. CVE-2026-60589: unauthenticated attacker with network access via multiple protocols can gain unauthorized read access to a subset of accessible data bsc1275777. CVE-2026-61308:...

Security update for java-25-openjdk

This update for java-25-openjdk fixes the following issues: CVE-2026-60589: OpenJDK: Improve Resource Resolving bsc1275777. CVE-2026-61308: OpenJDK: Enhance HTTP Connections bsc1275778. CVE-2026-70906: OpenJDK: Improve font loading bsc1275763. CVE-2026-70907: OpenJDK: Enhance TLS server bsc127576...

Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: Update to version jdk8u504 icedtea 3.40.1. CVE-2026-60589: unauthenticated attacker with network access via multiple protocols can gain unauthorized read access to sensitive data bsc1275777. CVE-2026-61308: unauthenticated attacker with...

ROS-20260907-73-0529

The vulnerability in Java 1.8.0-openjdk is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20260907-73-0528

The vulnerability in java-25-openjdk is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260907-73-0526

The vulnerability in Java-17-openJDK is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260907-73-0527

The vulnerability in Java-21-openjdk is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260907-73-0524

The vulnerability in Java 1.8.0-openjdk is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260907-73-0537

The vulnerability in Java-21-openjdk is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

ROS-20260907-73-0525

The vulnerability in Java-11-openjdk is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...