H3rmesk1t/Fastjson-Gadgets-Automatic-Scanner external links

---

GitHub - View repository

GitHub.dev - Open in online code editor

Star history - Growth chart over time

deps.dev - Dependencies and security vulnerabilities

Gitingest - Export source code for LLM usage

Repomix - Export source code for LLM usage

uithub - Export source code for LLM usage

Close

H3rmesk1t/Fastjson-Gadgets-Automatic-Scanner

Readme badge preview -

If you own this repo, copy the snippet below and add it to your README.md

---

Copy

[![RelatedRepos](https://img.shields.io/badge/related-repos-yellow)](https://relatedrepos.com/gh/H3rmesk1t/Fastjson-Gadgets-Automatic-Scanner)

Close

H3rmesk1t / Fastjson-Gadgets-Automatic-ScannerView on GitHubMore

• External links
• Readme badge

Automatically scan jar packages by using ast to find fastjson gadgets. In particular, this project is limited to mining Gadgets that may be exploited, and screening results need to be excluded by themselves. Looking forward to Fork and Star.

☆49Mar 8, 2022Updated 4 years ago

Alternatives and similar repositories for Fastjson-Gadgets-Automatic-Scanner

Users that are interested in Fastjson-Gadgets-Automatic-Scanner are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.

• SummerSec / LookupInterface

  View on GitHub
  CodeQL 寻找 JNDI利用 Lookup接口
  ☆166Apr 10, 2022Updated 4 years ago
• safe6Sec / codeql-grafana

  View on GitHub
  用codeql分析grafana最新任意文件读取
  ☆11Dec 10, 2021Updated 4 years ago
• Y4tacker / CodeqlLearn

  View on GitHub
  记录学习codeql的过程
  ☆10Jan 27, 2022Updated 4 years ago
• depycode / fastjson-c3p0

  View on GitHub
  fastjson不出网利用、c3p0
  ☆257Jul 30, 2021Updated 5 years ago
• hudangwei / codemillx

  View on GitHub
  codemillx is a tool for CodeQL, extract the comments in the code and generate codeql module. 强化Go开源项目安全检测(内含开源项目漏洞挖掘方法)
  ☆205Mar 19, 2022Updated 4 years ago
• Managed hosting for WordPress and PHP on Cloudways • Ad
  Managed hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
• timwhitez / CLR-RWX

  View on GitHub
  Load CLR to get RWX 通过加载clr在自身内存中产生rwx空间
  ☆21Sep 28, 2022Updated 4 years ago
• woodpecker-appstore / xmldecoder-payload-generator

  View on GitHub
  Java XMLDecoder payload generator
  ☆16Jul 27, 2021Updated 5 years ago
• west9b / CVE-2022-30525

  View on GitHub
  CVE-2022-30525 Zyxel 防火墙命令注入漏洞 POC&EXPC
  ☆12May 28, 2022Updated 4 years ago
• hosch3n / FastjsonVulns

  View on GitHub
  ☆92Jul 22, 2026Updated 3 months ago
• wheelerlaw / go-mimikatz

  View on GitHub
  An improvement over the original Mimikatz wrapper.
  ☆19Aug 11, 2021Updated 5 years ago
• hhxy / e-message_exp

  View on GitHub
  e-mesaage <=4.15 后台jar包上传exp
  ☆47Mar 15, 2019Updated 7 years ago
• theLSA / sunlogin-exp-cmd

  View on GitHub
  命令行版向日葵RCE漏洞利用工具 / cmd version of sunlogin exploit tool
  ☆14Mar 26, 2022Updated 4 years ago
• ethushiroha / JavaAgentTools

  View on GitHub
  用Java agent实现内存马等功能
  ☆198Jul 27, 2023Updated 3 years ago
• potats0 / javaSerializationTools

  View on GitHub
  ☆145Jan 21, 2021Updated 5 years ago
• Deploy on Railway without the complexity - Free Credits Offer • Ad
  Connect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
• Esonhugh / yapi-rce-webshell

  View on GitHub
  Yapi mock script RCE another version. Webshell way. 另一种 Webshell 方式的 Yapi 命令执行的方法 相比于其他的利用方式 更加微操和可控 影响更小
  ☆66Jul 4, 2024Updated 2 years ago
• depycode / fastjson-local-echo

  View on GitHub
  基于dbcp的fastjson rce 回显
  ☆197Jun 28, 2021Updated 5 years ago
• Rvn0xsy / Invoke-x64dbg-loaddll

  View on GitHub
  调用x64dbg中的loadll.exe白加黑示例代码
  ☆65Jun 18, 2024Updated 2 years ago
• hack2fun / gopher_attack_mssql

  View on GitHub
  Attack SQL Server through gopher protocol
  ☆21Nov 22, 2021Updated 4 years ago
• synacktiv / QLinspector

  View on GitHub
  Finding Java/C# gadget chains with CodeQL
  ☆188Oct 7, 2026Updated 3 weeks ago
• Firebasky / CodeqlLearn

  View on GitHub
  记录学习codeql的过程
  ☆397Jun 9, 2023Updated 3 years ago
• Drac0nids / SeeyonExploit

  View on GitHub
  基于go语言的致远OA漏洞检测工具
  ☆38Oct 28, 2022Updated 4 years ago
• BeichenDream / InjectJDBC

  View on GitHub
  注入JVM进程 动态获取目标进程连接的数据库
  ☆343Mar 6, 2022Updated 4 years ago
• tabby-sec / tabby-path-finder

  View on GitHub
  A neo4j procedure for tabby
  ☆135May 17, 2025Updated last year
• Deploy on Railway without the complexity - Free Credits Offer • Ad
  Connect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
• waderwu / extractor-java

  View on GitHub
  CodeQL extractor for java, which don't need to compile java source
  ☆344Nov 25, 2022Updated 3 years ago
• LeadroyaL / fastjson-blacklist

  View on GitHub
  ☆843Jun 7, 2022Updated 4 years ago
• qi4L / Ysoserial-go

  View on GitHub
  A Go library for generating Java deserialization payloads.
  ☆151Sep 9, 2024Updated 2 years ago
• bigBestWay / ice

  View on GitHub
  Use java instrument API without JAR file
  ☆49Jun 19, 2022Updated 4 years ago
• GitHubSecurityLab / gh-qldb

  View on GitHub
  CodeQL database manager
  ☆51Apr 16, 2025Updated last year
• wdahlenburg / spring-gateway-demo

  View on GitHub
  Sample Spring application to Demonstrate the Gateway Actuator
  ☆49Mar 3, 2022Updated 4 years ago
• Y4er / dotnet-deserialization

  View on GitHub
  dotnet 反序列化学习笔记
  ☆525Oct 19, 2023Updated 3 years ago
• BytecodeDL / soot-fact-generator

  View on GitHub
  generate facts from bytecode (source is https://github.com/plast-lab/doop-mirror/tree/master/generators)
  ☆22Nov 24, 2024Updated last year
• c0ny1 / java-object-searcher

  View on GitHub
  java内存对象搜索辅助工具
  ☆819Sep 23, 2022Updated 4 years ago
• Serverless GPU API endpoints on Runpod - Get Bonus Credits • Ad
  Skip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
• r1is / Magisk_burpsuite_cert

  View on GitHub
  Magisk burpsuite 证书模块，在安卓10以上通过magisk模块快速安装burpsuite证书
  ☆40Feb 2, 2023Updated 3 years ago
• f0ng / JavaFileDict

  View on GitHub
  Java应用的一些配置文件字典，来源于公开的字典与平时收集
  ☆319Feb 1, 2024Updated 2 years ago
• yzddmr6 / Java-Js-Engine-Payloads

  View on GitHub
  Java Js Engine Payloads All in one
  ☆288Aug 21, 2023Updated 3 years ago
• c1y2m3 / FileSearch

  View on GitHub
  C++枚举磁盘列表、遍历指定盘搜索特定类型文件/微信导出密钥,文件回传等功能
  ☆150Jan 9, 2023Updated 3 years ago
• cn-panda / ThymeleafSSTIBypass

  View on GitHub
  Thymeleaf SSTI Bypass
  ☆13Nov 24, 2021Updated 4 years ago
• idiotc4t / sharpwmi

  View on GitHub
  (批量化改造)sharpwmi是一个基于rpc的横向移动工具，具有上传文件和执行命令功能。
  ☆109Jan 8, 2021Updated 5 years ago
• keven1z / weblogic_memshell

  View on GitHub
  适用于weblogic和Tomcat的无文件的内存马(memshell)
  ☆271Mar 4, 2022Updated 4 years ago