cn-panda / logbackRceDemo
The project is a simple vulnerability Demo environment written by SpringBoot. Here, I deliberately wrote a vulnerability environment where there are arbitrary file uploads, and then use the `scan` attribute in the loghack configuration file to cooperate with the logback vulnerability to implement RCE.
☆87Updated 3 years ago
Alternatives and similar repositories for logbackRceDemo:
Users that are interested in logbackRceDemo are comparing it to the libraries listed below
- spring-cloud-function SpEL RCE, Vultarget & Poc☆133Updated 2 years ago
- Intentionally Vulnerable to Spring4Shell☆51Updated 2 years ago
- Java web and command line applications demonstrating various security topics☆235Updated last week
- jasypt Decrypt Encrypt☆14Updated 3 years ago
- A project demonstrating an app that is vulnerable to Spring Security authorization bypass CVE-2022-31692☆36Updated 2 years ago
- Sample Spring application to Demonstrate the Gateway Actuator☆48Updated 2 years ago
- ☆15Updated 4 years ago
- https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet☆49Updated 3 years ago
- Apache Solr RCE via Velocity template☆108Updated 5 years ago
- 个人用于在自动化挖掘gadget时，方便查找gadget chains中class所在jar包，以助于便捷审计测试gadget有效性的那么一个小工具。☆60Updated 4 years ago
- Slides/Demos from the BSides Munich 2019 talk "Attacking Java RMI in 2019"☆101Updated 5 years ago
- Test and monitor your projects for vulnerabilities with Maven. This plugin is officially maintained by Snyk.☆79Updated 5 months ago
- ☆182Updated 3 years ago
- Apache Log4j 1.2.X存在反序列化远程代码执行漏洞☆78Updated 5 years ago
- ☆92Updated last year
- Log4j_dos_CVE-2021-45105☆13Updated 3 years ago
- Vulnerability Environment Build with Dockerfile -> Docker Hub☆15Updated 2 months ago
- Exploit for WebSocket Vulnerability in Apache Tomcat☆165Updated 4 years ago
- WebLogic T3/IIOP RCE ExternalizableHelper.class of coherence.jar☆79Updated 4 years ago
- Unofficial Dockerfile and scripts for building CodeQL databases for the OpenJDK☆48Updated last year
- Library for manually creating Java serialization data.☆28Updated last year
- ZAP/Burp plugin that generate script to reproduce a specific HTTP request (Intended for fuzzing or scripted attacks)☆29Updated 3 years ago
- Nexus Repository Manager 3 Remote Code Execution without authentication < 3.15.0☆83Updated 5 years ago
- My CodeQL queries collection☆96Updated last year
- Custom / Experimental CodeQL queries☆37Updated 2 years ago
- A list for Spring Security☆119Updated last year
- log4j2-vaccine☆85Updated 3 years ago
- ☆185Updated 8 months ago
- 通过JavaAgent与Javassist技术对JVM加载的类对象进行动态插桩，可以做一些破解、加密验证的绕过等操作☆97Updated 7 months ago
- Native Java serialization filter blacklist for common gadgets☆20Updated 5 years ago