Alternatives and similar repositories for fastjson_gadgets_scanner

Users that are interested in fastjson_gadgets_scanner are comparing it to the libraries listed below

• 0Kee-Team / JavaProbe

  View on GitHub
  A Java runtime information-gathering tool which uses the Java Attach API for information acquisition
  ☆204Apr 26, 2021Updated 4 years ago
• mpgn / CVE-2019-0192

  View on GitHub
  RCE on Apache Solr using deserialization of untrusted data via jmx.serviceUrl
  ☆210Mar 10, 2019Updated 6 years ago
• pwntester / JRE8u20_RCE_Gadget

  View on GitHub
  JRE8u20_RCE_Gadget
  ☆255Jul 1, 2016Updated 9 years ago
• LeadroyaL / fastjson-blacklist

  View on GitHub
  ☆835Jun 7, 2022Updated 3 years ago
• lufeirider / CVE-2019-2725

  View on GitHub
  CVE-2019-2725 命令回显
  ☆436May 8, 2023Updated 2 years ago
• iSafeBlue / fastjson-autotype-bypass-demo

  View on GitHub
  fastjson 1.2.68 版本 autotype bypass
  ☆142Jun 17, 2022Updated 3 years ago
• welk1n / JNDI-Injection-Bypass

  View on GitHub
  Some payloads of JNDI Injection in JDK 1.8.0_191+
  ☆484Dec 9, 2020Updated 5 years ago
• codeplutos / java-security-manager-bypass

  View on GitHub
  ☆153Jun 24, 2019Updated 6 years ago
• veracode-research / solr-injection

  View on GitHub
  Apache Solr Injection Research
  ☆579Jan 28, 2020Updated 6 years ago
• petercunha / jenkins-rce

  View on GitHub
  Jenkins RCE PoC. From unauthenticated user to remote code execution, it's a hacker's dream!
  ☆297Jun 10, 2019Updated 6 years ago
• threedr3am / tomcat-cluster-session-sync-exp

  View on GitHub
  tomcat使用了自带session同步功能时，不安全的配置（没有使用EncryptInterceptor）导致存在的反序列化漏洞，通过精心构造的数据包， 可以对使用了tomcat自带session同步功能的服务器进行攻击。PS:这个不是CVE-2020-9484，9484…
  ☆212May 19, 2020Updated 5 years ago
• wuppp / shiro_rce_exp

  View on GitHub
  Shiro RCE (Padding Oracle Attack)
  ☆148Nov 15, 2019Updated 6 years ago
• T3st0r-Git / hack_postgres

  View on GitHub
  便捷地使用PostgreSQL自定义函数来执行系统命令，适用于数据库管理员知道postgres密码却不知道ssh或RDP密码的时候在服务器执行系统命令。
  ☆55Mar 10, 2020Updated 5 years ago
• kxcode / JNDI-Exploit-Bypass-Demo

  View on GitHub
  Demo code for post <Restrictions of JNDI Manipulation RCE & Bypass>
  ☆267Jun 17, 2022Updated 3 years ago
• Mel0day / RedTeam-BCS

  View on GitHub
  BCS（北京网络安全大会）2019 红队行动会议重点内容
  ☆821Sep 4, 2019Updated 6 years ago
• mpgn / CVE-2019-7238

  View on GitHub
  🐱‍💻 Poc of CVE-2019-7238 - Nexus Repository Manager 3 Remote Code Execution 🐱‍💻
  ☆153Feb 25, 2019Updated 6 years ago
• Y4er / fastjson-bypass-autotype-1.2.68

  View on GitHub
  fastjson bypass autotype 1.2.68 with Throwable and AutoCloseable.
  ☆229Oct 12, 2022Updated 3 years ago
• c0ny1 / FastjsonExploit

  View on GitHub
  Fastjson vulnerability quickly exploits the framework（fastjson漏洞快速利用框架）
  ☆1,387Dec 16, 2022Updated 3 years ago
• Artemis1029 / Java_xmlhack

  View on GitHub
  帮助java环境下任意文件下载情况自动化读取源码的小工具
  ☆167Apr 5, 2019Updated 6 years ago
• r3dxpl0it / Apache-Superset-Remote-Code-Execution-PoC-CVE-2018-8021

  View on GitHub
  CVE-2018-8021 Proof-Of-Concept and Exploit
  ☆106Dec 3, 2018Updated 7 years ago
• opensec-cn / chip

  View on GitHub
  a simple tool to detect potential security threat in php code
  ☆317Sep 9, 2024Updated last year
• shengqi158 / fastjson-remote-code-execute-poc

  View on GitHub
  fastjson remote code execute poc 直接用intellij IDEA打开即可 首先编译得到Test.class，然后运行Poc.java
  ☆403Dec 16, 2022Updated 3 years ago
• longofo / rmi-jndi-ldap-jrmp-jmx-jms

  View on GitHub
  rmi、jndi、ldap、jrmp、jmx、jms一些demo测试
  ☆310Jun 17, 2022Updated 3 years ago
• CHYbeta / CVE-2018-11235-DEMO

  View on GitHub
  ☆14Jun 7, 2018Updated 7 years ago
• codeplutos / MySQL-JDBC-Deserialization-Payload

  View on GitHub
  MySQL JDBC Deserialization Payload / MySQL客户端jdbc反序列化漏洞payload
  ☆13Feb 8, 2020Updated 6 years ago
• pwntester / SerialKillerBypassGadgetCollection

  View on GitHub
  Collection of bypass gadgets to extend and wrap ysoserial payloads
  ☆386Apr 16, 2022Updated 3 years ago
• WBGlIl / IIS_backdoor

  View on GitHub
  backdoor
  ☆262Jul 26, 2025Updated 6 months ago
• threedr3am / gadgetinspector

  View on GitHub
  一个利用ASM对字节码进行污点传播分析的静态代码审计应用（添加了大量代码注释，适合大家进行源码学习）。也加入了挖掘Fastjson反序列化gadget chains和SQLInject（JdbcTemplate、MyBatis、JPA、Hibernate、原生jdbc等）静…
  ☆458Mar 24, 2022Updated 3 years ago
• pwntester / XMLDecoder

  View on GitHub
  RCE Exploit PoC for XMLDecoder
  ☆63Aug 1, 2013Updated 12 years ago
• phith0n / realworldctf

  View on GitHub
  My Real World CTF challenges
  ☆115Sep 19, 2019Updated 6 years ago
• verctor / nexus_rce_CVE-2019-7238

  View on GitHub
  Some debug notes and exploit(not blind)
  ☆39Jul 28, 2019Updated 6 years ago
• lightless233 / Java-Unserialization-Study

  View on GitHub
  QAQ Just study unserialize vulnerabilities in Java :)
  ☆196Aug 22, 2018Updated 7 years ago
• airman604 / jdbc-backdoor

  View on GitHub
  A fake JDBC driver that allows OS command execution.
  ☆125Oct 2, 2022Updated 3 years ago
• l1nk3rlin / CVE-2019-2890

  View on GitHub
  ☆85Dec 6, 2019Updated 6 years ago
• fnmsd / zimbra_poc

  View on GitHub
  Zimbra XXE+SSRF+UPLOAD Poc
  ☆59Jun 25, 2019Updated 6 years ago
• momika233 / Joomla-3.4.6-RCE

  View on GitHub
  Joomla 3.4.6 – Remote Code Execution
  ☆109Jan 31, 2024Updated 2 years ago
• random-robbie / cve-2020-0688

  View on GitHub
  cve-2020-0688
  ☆166Feb 26, 2020Updated 5 years ago
• waderwu / attackRmi

  View on GitHub
  attackRmi
  ☆258Oct 14, 2020Updated 5 years ago
• mogwailabs / rmi-deserialization

  View on GitHub
  Slides/Demos from the BSides Munich 2019 talk "Attacking Java RMI in 2019"
  ☆101Sep 20, 2019Updated 6 years ago