Ruil1n/after-deserialization-attack external links

---

GitHub - View repository

GitHub.dev - Open in online code editor

Star history - Growth chart over time

deps.dev - Dependencies and security vulnerabilities

Gitingest - Export source code for LLM usage

Repomix - Export source code for LLM usage

uithub - Export source code for LLM usage

Close

Ruil1n/after-deserialization-attack

Readme badge preview -

If you own this repo, copy the snippet below and add it to your README.md

---

Copy

[![RelatedRepos](https://img.shields.io/badge/related-repos-yellow)](https://relatedrepos.com/gh/Ruil1n/after-deserialization-attack)

Close

Ruil1n / after-deserialization-attackView on GitHubMore

• External links
• Readme badge

Java After-Deserialization Attack

☆79Apr 26, 2021Updated 5 years ago

Alternatives and similar repositories for after-deserialization-attack

Users that are interested in after-deserialization-attack are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.

• pwntester / JRE8u20_RCE_Gadget

  View on GitHub
  JRE8u20_RCE_Gadget
  ☆254Jul 1, 2016Updated 10 years ago
• flowerwind / AutoGenerateXalanPayload

  View on GitHub
  cve-2022-34169 延伸出的Jdk Xalan的payload自动生成工具，可根据不同的Jdk生成出其所对应的xslt文件
  ☆94Jan 17, 2023Updated 3 years ago
• codeplutos / MySQL-JDBC-Deserialization-Payload

  View on GitHub
  MySQL JDBC Deserialization Payload / MySQL客户端jdbc反序列化漏洞payload
  ☆13Feb 8, 2020Updated 6 years ago
• threedr3am / gadgetinspector

  View on GitHub
  一个利用ASM对字节码进行污点传播分析的静态代码审计应用（添加了大量代码注释，适合大家进行源码学习）。也加入了挖掘Fastjson反序列化gadget chains和SQLInject（JdbcTemplate、MyBatis、JPA、Hibernate、原生jdbc等）静…
  ☆454Mar 24, 2022Updated 4 years ago
• iSafeBlue / fastjson-autotype-bypass-demo

  View on GitHub
  fastjson 1.2.68 版本 autotype bypass
  ☆139Aug 9, 2026Updated 2 months ago
• Deploy on Railway without the complexity - Free Credits Offer • Ad
  Connect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
• longofo / rmi-jndi-ldap-jrmp-jmx-jms

  View on GitHub
  rmi、jndi、ldap、jrmp、jmx、jms一些demo测试
  ☆310Jun 17, 2022Updated 4 years ago
• threedr3am / FindClassInJars

  View on GitHub
  个人用于在自动化挖掘gadget时，方便查找gadget chains中class所在jar包，以助于便捷审计测试gadget有效性的那么一个小工具。
  ☆60Mar 25, 2020Updated 6 years ago
• mogwailabs / deserialization-filter-blacklists

  View on GitHub
  Native Java serialization filter blacklist for common gadgets
  ☆20Sep 12, 2019Updated 7 years ago
• Lonely-night / fastjson_gadgets_scanner

  View on GitHub
  ☆131Jun 17, 2022Updated 4 years ago
• voidfyoo / rwctf-2021-old-system

  View on GitHub
  ☆78Jan 12, 2021Updated 5 years ago
• waderwu / attackRmi

  View on GitHub
  attackRmi
  ☆259Oct 14, 2020Updated 6 years ago
• threedr3am / tomcat-cluster-session-sync-exp

  View on GitHub
  tomcat使用了自带session同步功能时，不安全的配置（没有使用EncryptInterceptor）导致存在的反序列化漏洞，通过精心构造的数据包， 可以对使用了tomcat自带session同步功能的服务器进行攻击。PS:这个不是CVE-2020-9484，9484…
  ☆214May 19, 2020Updated 6 years ago
• welk1n / JNDI-Injection-Bypass

  View on GitHub
  Some payloads of JNDI Injection in JDK 1.8.0_191+
  ☆486Dec 9, 2020Updated 5 years ago
• airman604 / jdbc-backdoor

  View on GitHub
  A fake JDBC driver that allows OS command execution.
  ☆124Oct 2, 2022Updated 4 years ago
• AI Agents on DigitalOcean Gradient AI Platform • Ad
  Build production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
• Ant-FG-Lab / non_RCE

  View on GitHub
  ☆41Mar 10, 2021Updated 5 years ago
• angelwhu / jvm-rasp

  View on GitHub
  基于JVM-Sandbox实现RASP安全监控防护
  ☆51Aug 8, 2023Updated 3 years ago
• codeplutos / java-security-manager-bypass

  View on GitHub
  ☆154Jun 24, 2019Updated 7 years ago
• LeadroyaL / fastjson-blacklist

  View on GitHub
  ☆843Jun 7, 2022Updated 4 years ago
• feihong-cs / jre8u20_gadget

  View on GitHub
  jre8u20 gadget
  ☆34May 23, 2021Updated 5 years ago
• waderwu / nativeRasp

  View on GitHub
  nativeRasp that can hook native methods
  ☆23Apr 24, 2023Updated 3 years ago
• pwntester / SerialKillerBypassGadgetCollection

  View on GitHub
  Collection of bypass gadgets to extend and wrap ysoserial payloads
  ☆390Apr 16, 2022Updated 4 years ago
• feihong-cs / Java-Rce-Echo

  View on GitHub
  Java RCE 回显测试代码
  ☆1,008Oct 15, 2020Updated 6 years ago
• Afant1 / RemoteObjectInvocationHandler

  View on GitHub
  bypass JEP290 RaspHook code
  ☆63Sep 21, 2020Updated 6 years ago
• AI Agents on DigitalOcean Gradient AI Platform • Ad
  Build production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
• zema1 / ysoserial

  View on GitHub
  A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
  ☆357Sep 20, 2022Updated 4 years ago
• Ramos-dev / R9000

  View on GitHub
  ☆56Apr 27, 2020Updated 6 years ago
• Ramos-dev / graph4code

  View on GitHub
  超硬核！使用图数据技术发现软件漏洞
  ☆184Sep 1, 2021Updated 5 years ago
• QAX-A-Team / WeblogicEnvironment

  View on GitHub
  Weblogic环境搭建工具
  ☆799Apr 23, 2020Updated 6 years ago
• mogwailabs / rmi-deserialization

  View on GitHub
  Slides/Demos from the BSides Munich 2019 talk "Attacking Java RMI in 2019"
  ☆101Sep 20, 2019Updated 7 years ago
• 5wimming / gadgetinspector

  View on GitHub
  利用链、漏洞检测工具
  ☆376Jul 31, 2024Updated 2 years ago
• phith0n / zkar

  View on GitHub
  ZKar is a Java serialization protocol analysis tool implement in Go.
  ☆656Apr 19, 2026Updated 6 months ago
• ceclin / 0ctf-2021-finals-soln-buggy-loader

  View on GitHub
  solution to buggyLoader of 0CTF/TCTF 2021 Finals
  ☆20Sep 27, 2021Updated 5 years ago
• fynch3r / WALAStudy

  View on GitHub
  WALA 学习笔记
  ☆14Aug 8, 2023Updated 3 years ago
• Deploy on Railway without the complexity - Free Credits Offer • Ad
  Connect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
• c0ny1 / java-object-searcher

  View on GitHub
  java内存对象搜索辅助工具
  ☆819Sep 23, 2022Updated 4 years ago
• threedr3am / log-agent

  View on GitHub
  利用agent hock指定的class，在jar运行周期内，用于跟踪被执行的方法，辅助做一些事情，比如挖洞啊
  ☆123Jul 17, 2020Updated 6 years ago
• wh1t3p1g / ysomap

  View on GitHub
  A helpful Java Deserialization exploit framework.
  ☆1,246Feb 17, 2025Updated last year
• kxcode / JNDI-Exploit-Bypass-Demo

  View on GitHub
  Demo code for post <Restrictions of JNDI Manipulation RCE & Bypass>
  ☆265Jun 17, 2022Updated 4 years ago
• threedr3am / ysoserial

  View on GitHub
  A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.优化了一些东西。
  ☆210Jan 17, 2022Updated 4 years ago
• Y4er / CVE-2020-2555

  View on GitHub
  Weblogic com.tangosol.util.extractor.ReflectionExtractor RCE
  ☆177Dec 15, 2022Updated 3 years ago
• LandGrey / spring-boot-upload-file-lead-to-rce-tricks

  View on GitHub
  spring boot Fat Jar 任意写文件漏洞到稳定 RCE 利用技巧
  ☆756Apr 14, 2021Updated 5 years ago