4703 matches found
zkar
ZKar ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress , so no complete API document and contribution guide. ZKar provides: A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required From the Java serialization...
XStream-1
master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. Xpp3 is recommend for use as it will greatly improve the performance...
CVE-2026-83609
A flaw was found in xmldom. The XML DOM Document Object Model parser incorrectly validates XML names, allowing embedded line terminators. This vulnerability enables an attacker to inject additional markup into XML documents during serialization, potentially leading to malformed XML output...
CVE-2025-55182-PoC
⚡ React2Shell Exploit PoC CVE-2025-66478 Next.js Remote Code Execution RCE via Prototype Pollution in Server Components 🕵️♂️ Overview This repository contains a Proof of Concept PoC for CVE-2025-66478 also referenced as CVE-2025-55182 in some contexts, a critical vulnerability affecting Next.js...
x-stream__xstream_CVE-2021-21345_1-4-15
master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. Xpp3 is recommend for use as it will greatly improve the performance...
jenkins-cve-2016-0792
Jenkins CVE-2016-0792 Exploit for Jenkins serialization vulnerability - CVE-2016-0792 Exploit database https://www.exploit-db.com/exploits/42394/ More information can be found here 1. Contrast Security 2. Pentester Lab Requirements 1. Python 3.6.x 2. requests library is required for this exploit ...
LeakValue
Android 13 introduces many enhancements in order to harden Parcel serialization mechanism Here's presentation from Android Security and Privacy team on enhancements made That is great, definitely eliminates or makes unexploitable many vulnerabilities. Also they describe breaking my previous...
pbtk
pbtk - Reverse engineering Protobuf apps Protobuf is a serialization format developed by Google and used in an increasing number of Android, web, desktop and more applications. It consists of a language for declaring data structures , which is then compiled to code or another kind of structure...
cve-2023-34040
CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution root@kitploit: POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0...
CVE-2020-9496
CVE-2020-9496 - RCE Because the 2 xmlrpc related requets in webtools xmlrpc and ping are not using authentication they are vulnerable to unsafe deserialization. This issue was reported to the security team by Alvaro Munoz [email protected] from the GitHub Security Lab team. This vulnerabilit...
AMFDSer-ngng
AMFDSer-ngng A Burp Extender plugin, that will take deserialized AMF objects and encode them in XML using the Xtream library. Based on the original work of Khai Tran, all hail https://blog.netspi.com/ AMFDSer-ngng also utilizes part of Kenneth Hill's Jmeter source code for custom AMF...
x-stream__xstream_CVE-2020-26217_1-4-14-java77
master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. MXParser is recommend for use as it will greatly improve the...
SilkETW
SilkETW & SilkService SilkETW & SilkService are flexible C wrappers for ETW, they are meant to abstract away the complexities of ETW and give people a simple interface to perform research and introspection. While both projects have obvious defensive and offensive applications they should primaril...
CVE-2025-14847-MongoDB
CVE-2025-14847-MongoDB Memory Disclosure Research Tool Overview This repository contains an educational research tool designed to demonstrate the memory safety concepts behind CVE-2025-14847, a critical vulnerability discovered in MongoDB's BSON decompression implementation. The tool simulates ho...
zkar
ZKar ZKar es una herramienta de análisis del protocolo de serialización de Java implementada en Go. Esta herramienta aún está en desarrollo , por lo que no hay una guía de API completa ni de contribución. ZKar proporciona: Un analizador y visor de cargas útiles de serialización de Java en Go puro...
sobelow
Sobelow Sobelow is a security-focused static analysis tool for Elixir & the Phoenix framework. For security researchers, it is a useful tool for getting a quick view of points-of-interest. For project maintainers, it can be used to prevent the introduction of a number of common vulnerabilities...
WCFDSer-ngng
WCFDSer-ngng A Burp Extender plugin, that will make binary soap objects readable and modifiable. Based on the original work of Brian Holyfield, all hail Brian http://blog.gdssecurity.com/labs/2009/11/19/wcf-binary-soap-plug-in-for-burp.html Why? This release fixes a bug where serialization wasn't...
CVE-2017-13286
CVE-2017-13286 CVE-2017-13286 Poccannot use All resources are sourced from this article https://bbs.kanxue.com/thread-268506.htm The main cause of this vulnerability is the inconsistency between reading and writing of Parcel objects. It can be traced back to the following code root@kitploit: publ...
jenkins-cve-2016-0792
Jenkins CVE-2016-0792 Exploit para la vulnerabilidad de serialización de Jenkins - CVE-2016-0792 Base de datos de exploits https://www.exploit-db.com/exploits/42394/ Más información aquí 1. Contrast Security 2. Pentester Lab Requisitos 1. Python 3.6.x 2. La librería requests es necesaria para que...