semgrep-rules

semgrep-rules "The attack surface is the vulnerability. Finding a bug there is just a detail." -- Mark Dowd "Some details are more important than others." -- Fedor G. Pikus A collection of my Semgrep rules to facilitate vulnerability research. Blog posts...

kaiju

CERT Kaiju Binary Analysis Framework for GHIDRA CERT Kaiju is a collection of binary analysis tools for Ghidra. This is a Ghidra/Java implementation of some features of the CERT Pharos Binary Analysis Frameworkpharos, particularly the function hashing and malware analysis tools, but is expected t...

splinter

splinter splinter is a jvm analysis toolkit, allowing the user to view classes, methods, fields, constant pools and bytecode on runtime. this was made and tested on openjdk build 22.0.2+9-70 what is splinter? usually, when you think of an analysis toolkit for the jvm, you would think it uses jni ...

java-remote-class-loader

This tool allows you to send Java bytecode in the form of class files to your clients or potential targets to load and execute using Java ClassLoader together with Reflect API. The client receives the class file from the server and return the respective execution output. Payloads must be written ...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

hot-jar-swapping-urlclassloader

URLClassLoader hot jar swapping The following example code shows the ability to hot jar swap an already loaded JAR-file and get code execution by abusing the fact that inner classes still access the JAR file when invoked, as long as the inode does not change. Tested on MacOS with OpenJDK And also...

CVE-2025-24813

Testing any tomcat version to see whether that version is vulnerable to CVE-2025-24813 This POC allow you to test any tomcat version to verify whether that version is vulnerable to CVE-2025-24813 under the vulnerable conditions, in Unix environments tested on a Ubuntu machine. Note: tested using...

log4shell-vulnerable-app

Vulnerable application This repository contains a Spring Boot web application vulnerable to CVE-2021-44228, known as log4shell. It uses log-4j-core:2.14.1 through spring-boot-starter-log4j2 and openjdk:8u181 Running the application Run it: docker run --name vulnerable-app --rm -p 8080:8080...

CVE-2023-46604

CVE-2023-46604 By Ruben Fobe & Klaas Stessens Intro WARNING This project is intended for educational and lab purposes only. Only use these techniques in environments you own or are authorized to test. This lab will simulate the exploitation of CVE-2023-46604, by using a Kali Linux VM attacker and...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenJDK 25 vulnerabilities (USN-8681-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8681-1 advisory. It was discovered that the JSSE component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly us...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenJDK 17 vulnerabilities (USN-8676-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8676-1 advisory. It was discovered that the JSSE component of OpenJDK 17 did not correctly authenticate users. A remote...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenJDK 8 vulnerabilities (USN-8673-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8673-1 advisory. It was discovered that the JSSE component of OpenJDK 8 did not correctly authenticate users. ...

Ubuntu 26.04 LTS : OpenJDK 26 vulnerabilities (USN-8689-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8689-1 advisory. It was discovered that the JSSE component of OpenJDK 26 did not correctly authenticate users. A remote attacker could possibly use this issue to read or...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenJDK 11 vulnerabilities (USN-8674-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8674-1 advisory. It was discovered that the JSSE component of OpenJDK 11 did not correctly authenticate users. A remote...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenJDK 21 vulnerabilities (USN-8677-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8677-1 advisory. It was discovered that the JSSE component of OpenJDK 21 did not correctly authenticate users. A remote attacker could...

CVE-2022-34169

Description Checks if CVE-2022-34169 is fixed on your machine. As far as I know, an exploit was found by a Google employee and not published. Since the fix is known, a small test routine was written with this to check whether the fix is available at runtime. Build yourself optional Optional: This...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

SUSE SLES12: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc (SUSE-SU-2026:4515-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4515-1 advisory. - CVE-2026-60589: improve resource resolving bsc1275777. - CVE-2026-61308: enhance HTTP connections bsc1275778. - CVE-2026-70907:...

Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: CVE-2026-60589: improve resource resolving bsc1275777. CVE-2026-61308: enhance HTTP connections bsc1275778. CVE-2026-70907: enhance TLS server bsc1275764. Changes for java-11-openjdk: Upgrade to jdk-11.0.32.1+1 August 2026 CSPU Patch...