splinter

splinter splinter is a jvm analysis toolkit, allowing the user to view classes, methods, fields, constant pools and bytecode on runtime. this was made and tested on openjdk build 22.0.2+9-70 what is splinter? usually, when you think of an analysis toolkit for the jvm, you would think it uses jni ...

java-remote-class-loader

This tool allows you to send Java bytecode in the form of class files to your clients or potential targets to load and execute using Java ClassLoader together with Reflect API. The client receives the class file from the server and return the respective execution output. Payloads must be written ...

kaiju

CERT Kaiju Binary Analysis Framework for GHIDRA CERT Kaiju is a collection of binary analysis tools for Ghidra. This is a Ghidra/Java implementation of some features of the CERT Pharos Binary Analysis Framework, particularly the function hashing and malware analysis tools, but is expected to grow...

CVE-2022-34169

Descripción Comprueba si CVE-2022-34169 está corregido en tu máquina. Hasta donde sé, un empleado de Google encontró un exploit y no fue publicado. Dado que la corrección es conocida, se escribió una pequeña rutina de prueba para verificar si la corrección está disponible en tiempo de ejecución...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

semgrep-rules

semgrep-rules "The attack surface is the vulnerability. Finding a bug there is just a detail." -- Mark Dowd "Some details are more important than others." -- Fedor G. Pikus A collection of my Semgrep rules to facilitate vulnerability research. Blog posts...

hot-jar-swapping-urlclassloader

URLClassLoader hot jar swapping The following example code shows the ability to hot jar swap an already loaded JAR-file and get code execution by abusing the fact that inner classes still access the JAR file when invoked, as long as the inode does not change. Tested on MacOS with OpenJDK And also...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenJDK 25 vulnerabilities (USN-8783-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8783-1 advisory. Weber Leon discovered that the 2D component of OpenJDK 25 did not correctly handle user authentication. A remote attacker could...

log4shell-vulnerable-app

Vulnerable application This repository contains a Spring Boot web application vulnerable to CVE-2021-44228, known as log4shell. It uses log-4j-core:2.14.1 through spring-boot-starter-log4j2 and openjdk:8u181 Running the application Run it: root@kitploit: docker run --name vulnerable-app --rm -p...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

openjdk-orb: unauthed class loading via IIOP in EAP

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

openjdk-orb: unauthed class loading via IIOP in EAP

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

openjdk-orb: unauthed class loading via IIOP in EAP

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

CVE-2025-24813

Probando cualquier versión de Tomcat para ver si esa versión es vulnerable a CVE-2025-24813 Este POC permite probar cualquier versión de Tomcat para verificar si esa versión es vulnerable a CVE-2025-24813 bajo las condiciones vulnerables, en entornos Unix probado en una máquina Ubuntu. Nota:...

CVE-2023-46604

CVE-2023-46604 By Ruben Fobe & Klaas Stessens Intro WARNING This project is intended for educational and lab purposes only. Only use these techniques in environments you own or are authorized to test. This lab will simulate the exploitation of CVE-2023-46604, by using a Kali Linux VM attacker and...

USN-8796-1: OpenJDK 21 vulnerabilities

Kai Aizen discovered that the Networking component of OpenJDK 21 did not correctly handle user authentication. A remote attacker could possibly use this issue to leak sensitive information. CVE-2026-61308 It was discovered that the JSSE component of OpenJDK 21 did not correctly handle user...

USN-8796-1 openjdk-21 vulnerabilities

Kai Aizen discovered that the Networking component of OpenJDK 21 did not correctly handle user authentication. A remote attacker could possibly use this issue to leak sensitive information. CVE-2026-61308 It was discovered that the JSSE component of OpenJDK 21 did not correctly handle user...

USN-8795-1 openjdk-17 vulnerabilities

Kai Aizen discovered that the Networking component of OpenJDK 17 did not correctly handle user authentication. A remote attacker could possibly use this issue to leak sensitive information. CVE-2026-61308 It was discovered that the JSSE component of OpenJDK 17 did not correctly handle user...