Exploit for Deserialization of Untrusted Data in Fortra Goanywhere_Managed_File_Transfer

Structure du projet cve-2023-0669-simulation/ ├── docker-comp...

JavaLearnVulnerability

This is a Java vulnerability learning project repository, specifically focused on deserialization vulnerabilities. The repository contains a gadget called "URLDNS" which is used to verify if a target exists a deserialization vulnerability. The gadget is implemented using Java's built-in classes a...

ysoserial

This is a Java-based tool called ysoserial, which generates payloads that exploit unsafe Java object deserialization. The tool is designed to create payloads that can be used to attack vulnerable Java applications. The tool uses a variety of payloads, including CommonsCollectionsK1,...

Exploit for Deserialization of Untrusted Data in Redhat Data_Grid

This repository contains a collection of Python scripts for exploiting Java deserialization vulnerabilities in various applications, including Cisco Prime Infrastructure, JBoss, Jenkins, and OpenNMS. The scripts use the ysoserial tool to generate the payload. The scripts can be categorized into...

Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server

CVE-2018-2628 CVE-2018-2628漏洞工具包 根据Github上整理出的漏洞利用工具包含： 1.CVE-2018-2628漏洞检测工具 //漏洞存在检测的POC 2.weblogicpoc.py //漏洞利用的POC 3.ysoserial-0.1-cve-2018-2628-all.jar //借鉴的漏洞利用工具https://github.com/tdy218/ysoserial-cve-2018-2628/releases 具体的漏洞复现过程请移步简书：https://www.jianshu.com/p/6649118ba7b6...

Exploit for Improper Authentication in Microsoft

It is an exploit module targeting Microsoft Exchange Server. The primary CVE ID is CVE-2020-0688. The vulnerability class is a deserialization vulnerability, specifically a TextFormattingRunProperties deserialization vulnerability. The probable entry point is the exploit.py script. Notable...

Exploit for CVE-2017-3251

PoC exploit for CVE-2017-3251, a Java object deserialization vulnerability. The ysoserial tool generates payloads that exploit this vulnerability by creating a malicious object that, when deserialized, executes arbitrary code. The tool takes a user-specified command and wraps it in a gadget chain...

Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server

CVE-2018-2628 Weblogic GetShell.py is a Python script that exploits the Oracle Weblogic Server 10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3 deserialization remote command execution vulnerability. The script generates a payload using the ysoserial tool and sends it to the target server using a socket...

java reverse sequence tool ysoserial analysis-vulnerability warning-the black bar safety net

About java deserialization vulnerability the principles of analysis, basic are is in the analysis of the use of the Apache Commons Collections library, causing deserialization problems. However, downloading foreigner ysoserial tool and carefully look after, I found many worthy of learning the...