Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @JSONType resource probe (CVE-2026-16723). fastjson2 2.0.57: attacker @type reaches loadClass with autoType DISABLED via polymorphic types (@JSONType(seeAlso) / Jackson @JsonSubTypes). Marker-only payloads; safeMode + JDK17 controls.
☆207Jul 27, 2026Updated 3 months ago
Alternatives and similar repositories for fastjson-jsontype-rce-lab
Users that are interested in fastjson-jsontype-rce-lab are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- 【已复现】Fastjson 1.2.66–1.2.83 JsonType 纯库一键 RCE（AutoType 关闭仍可利用；完整 RCE 需 JDK8 + Spring Boot LaunchedURLClassLoader）。仅限授权安全研究与本地防御验证。☆90Jul 21, 2026Updated 3 months ago
- RCE PoC for Redis 6.2.22, 7.4.9, 8.6.4, 8.8.0, 8.8.1☆521Jul 24, 2026Updated 3 months ago
- Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to…☆13Sep 23, 2026Updated last month
- ☆23May 1, 2026Updated 6 months ago
- MariaDB 13.0.1-rc RCE lab — priv-esc + heap UAF + JOP chain to system() as uid 999(mysql) on stock Docker image. Found with RAPTOR and ra…☆69Aug 3, 2026Updated 3 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- FastJson全版本Docker漏洞环境(涵盖1.2.47/1.2.68/1.2.80等版本)，主要包括JNDI注入及高版本绕过、waf绕过、文件读写、原生反序列化、利用链探测绕过、不出网利用等。从黑盒的角度覆盖FastJson深入利用☆1,250Jul 12, 2024Updated 2 years ago
- Microsoft SharePoint JWT Authentication Bypass (CVE-2026-55040)☆59Aug 10, 2026Updated 2 months ago
- Java Vulnerability Exploitation Platform☆2,196Oct 26, 2026Updated last week
- Fastjson 1.2.68 ~ 1.2.83 RCE，jdk8、17、21和25全版本，支持批量urls进行poc验证。☆37Jul 21, 2026Updated 3 months ago
- 🚀 2024-至今 1Day 漏洞 PoC 深度研究与复现归档。涵盖 OA、ERP、安防、数通、大模型及容器等 高价值资产漏洞，实战导向，助力安全研究与合规检测。☆1,228Updated this week
- 一款专注于 Java 主流 Web 中间件的内存马快速生成工具，致力于简化安全研究人员和红队 成员的工作流程，提升攻防效率☆1,615Updated this week
- Nacos JRaft Hessian 反序列化 RCE 加载字节码 注入内存马 不出网利用☆855Jul 7, 2023Updated 3 years ago
- Jar Analyzer - 一个 JAR 包 GUI 分析工具，内置 AI 助手协助分析，支持 JAR DIFF 分析，方法调用关系搜索，方法调用链 DFS 算法分析，模拟 JVM 的污点分析验证 DFS 结果，字符串搜索，Java Web 组件入口分析，CFG 程序分析…☆2,186Oct 29, 2026Updated last week
- 红队浏览器插件-检测VUE站点未授权漏洞☆950May 7, 2026Updated 6 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- 专注于代码审计skill，最小化轻量化skill，只负责安全边界。☆1,043Jun 16, 2026Updated 4 months ago
- 多功能 java agent 内存马☆528Oct 8, 2023Updated 3 years ago
- 存储桶遍历漏洞利用工具☆500Jul 24, 2026Updated 3 months ago
- 一款支持自定义的 Java 内存马生成工具｜A customizable Java in-memory webshell generation tool.☆2,228Aug 21, 2025Updated last year
- FTP lnk调用pythonw程序，用于攻防钓鱼场景下免杀运行捆绑木马文件☆80Aug 27, 2024Updated 2 years ago
- 🔍 CodeAuditAssistant - JetBrains Code Audit Plugin (Beta) ⚡ Deep Call-Chain Tracking | 🚀 Method/Class Search | 🔥 Prebuilt Vuln Sink…☆778Mar 14, 2026Updated 7 months ago
- ☆269Mar 31, 2026Updated 7 months ago
- Godzilla插件|内存马|Suo5内存代理｜自定义字节码执行｜memShellParty-Godzilla☆246Sep 14, 2026Updated last month
- ☆28Oct 25, 2026Updated last week
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Fastjson姿势技巧集合☆1,860Oct 20, 2023Updated 3 years ago
- 哥斯拉webshell管理工具二开☆439Updated this week
- 最强大的密码爆破/喷洒工具 | The most powerful bruteforcer / sprayer Artifact☆389Aug 9, 2026Updated 2 months ago
- JavaGadgetGenerator 工具，支持 ysoserial，Hessian，字节码，Expr/SSTI，Shiro，JDBC 等 Gadget 生成，封装，混淆，出网延迟探测，内存马注入等...☆574Sep 12, 2026Updated last month
- 本程序为美国NSA的方程式工具包图形界面版，由ABC_123于2017年开始编写，仅用来扫描和验证MS17-010、MS09-050、MS08-067漏洞，并可协助管理员修复系统漏洞。☆572Jul 27, 2026Updated 3 months ago
- 纯 Java 实现的 MySQL Fake Server | 支持 GUI 版和命令行版 | 支持反序列化和文件读取的利用方式 | 支持常见的 GADGET 和自定义 GADGET 数据 | 根据目标环境自动生成匹配的 PAYLOAD | 支持 PGSQL 和 DERBY …☆831Sep 18, 2023Updated 3 years ago
- Extract website information from Vue☆281Aug 29, 2023Updated 3 years ago
- EZ是一款集信息收集、端口扫描、服务暴破、URL爬虫、指纹识别、被动扫描为一体的跨平台漏洞扫描器。☆1,078Jan 17, 2025Updated last year
- 用友漏洞综合利用工具☆272Nov 9, 2024Updated last year
- Deploy open-source AI quickly and easily - Special Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- JDBC Attack Tricks☆155Sep 3, 2023Updated 3 years ago
- 一款支持自定义的 Java 回显载荷生成工具｜A customizable Java echo payload generation tool.☆464Jan 12, 2025Updated last year
- Cairn is a general-purpose AI state-space search engine, validated first on autonomous penetration testing. Sometimes misspelled as Carin…☆4,874Sep 7, 2026Updated last month
- 让fscan再次伟大☆374Sep 28, 2026Updated last month
- java-web 自动化鉴权绕过☆380Apr 3, 2025Updated last year
- 一款高性能 HTTP 内存代理 | 哥斯拉插件 | readteam | 红队 | 内存马 | Suo5 | Godzilla | 正向代理☆297Aug 8, 2023Updated 3 years ago
- 高性能 HTTP 正向代理工具 | A high-performance http tunneling tool☆2,845Jul 14, 2026Updated 3 months ago