mishmashclone/GrrrDog-Java-Deserialization-Cheat-Sheet external links

---

GitHub - View repository

GitHub.dev - Open in online code editor

Star history - Growth chart over time

deps.dev - Dependencies and security vulnerabilities

Gitingest - Export source code for LLM usage

Repomix - Export source code for LLM usage

uithub - Export source code for LLM usage

Close

mishmashclone/GrrrDog-Java-Deserialization-Cheat-Sheet

Readme badge preview -

If you own this repo, copy the snippet below and add it to your README.md

---

Copy

[![RelatedRepos](https://img.shields.io/badge/related-repos-yellow)](https://relatedrepos.com/gh/mishmashclone/GrrrDog-Java-Deserialization-Cheat-Sheet)

Close

mishmashclone / GrrrDog-Java-Deserialization-Cheat-SheetView on GitHubMore

• External links
• Readme badge

https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet

☆54Sep 11, 2021Updated 4 years ago

Alternatives and similar repositories for GrrrDog-Java-Deserialization-Cheat-Sheet

Users that are interested in GrrrDog-Java-Deserialization-Cheat-Sheet are comparing it to the libraries listed below

• mogwailabs / deserialization-filter-blacklists

  View on GitHub
  Native Java serialization filter blacklist for common gadgets
  ☆20Sep 12, 2019Updated 6 years ago
• waderwu / attackRmi

  View on GitHub
  attackRmi
  ☆258Oct 14, 2020Updated 5 years ago
• Marcono1234 / codeql-jdk-docker

  View on GitHub
  Unofficial Dockerfile and scripts for building CodeQL databases for the OpenJDK
  ☆49Jan 7, 2024Updated 2 years ago
• Afant1 / RemoteObjectInvocationHandler

  View on GitHub
  bypass JEP290 RaspHook code
  ☆63Sep 21, 2020Updated 5 years ago
• welk1n / FastjsonPocs

  View on GitHub
  一些结合第三方组件的Fastjson POC，在1.2.48以后版本中陆续被添加至黑名单。
  ☆56Oct 29, 2019Updated 6 years ago
• mogwailabs / rmi-deserialization

  View on GitHub
  Slides/Demos from the BSides Munich 2019 talk "Attacking Java RMI in 2019"
  ☆101Sep 20, 2019Updated 6 years ago
• Jarijaas / helsec-1103

  View on GitHub
  ☆22Nov 3, 2022Updated 3 years ago
• 0linlin0 / CyberBox

  View on GitHub
  Java Exp FrameWork
  ☆104Apr 23, 2021Updated 4 years ago
• pwntester / JRE8u20_RCE_Gadget

  View on GitHub
  JRE8u20_RCE_Gadget
  ☆255Jul 1, 2016Updated 9 years ago
• TomAPU / ThinkPHP-Unserialize-Collection

  View on GitHub
  ThinkPHP各版本反序列化利用代码
  ☆32Aug 13, 2020Updated 5 years ago
• 5wimming / gadgetinspector

  View on GitHub
  利用链、漏洞检测工具
  ☆373Jul 31, 2024Updated last year
• OneSourceCat / BcelPayloadGenerator

  View on GitHub
  A fastjson payload generator
  ☆59Oct 13, 2020Updated 5 years ago
• threedr3am / tomcat-cluster-session-sync-exp

  View on GitHub
  tomcat使用了自带session同步功能时，不安全的配置（没有使用EncryptInterceptor）导致存在的反序列化漏洞，通过精心构造的数据包， 可以对使用了tomcat自带session同步功能的服务器进行攻击。PS:这个不是CVE-2020-9484，9484…
  ☆212May 19, 2020Updated 5 years ago
• boundaryx / cloudrasp-log4j2

  View on GitHub
  一个针对防御 log4j2 CVE-2021-44228 漏洞的 RASP 工具。 A Runtime Application Self-Protection module specifically designed for log4j2 RCE (CVE-2021-442…
  ☆126Dec 11, 2021Updated 4 years ago
• jas502n / Shiro_Xray

  View on GitHub
  CommonsBeanutils1,CommonsCollectionsK1
  ☆58Nov 16, 2020Updated 5 years ago
• BeichenDream / Kcon2021Code

  View on GitHub
  ☆274Oct 28, 2021Updated 4 years ago
• longofo / rmi-jndi-ldap-jrmp-jmx-jms

  View on GitHub
  rmi、jndi、ldap、jrmp、jmx、jms一些demo测试
  ☆310Jun 17, 2022Updated 3 years ago
• pyn3rd / Apache-Tomcat-MongoDB-Remote-Code-Execution

  View on GitHub
  Apache Tomcat + MongoDB Remote Code Execution
  ☆113Jan 15, 2021Updated 5 years ago
• threedr3am / jar-compatibility-detector

  View on GitHub
  安全升级jar包时，辅助检测Java Archive (JAR) 包之间兼容性，各类符号引用的存在检测，包括方法、方法签名、字段定义和引用、类引用等等
  ☆14Jul 7, 2024Updated last year
• PalindromeLabs / Java-Deserialization-CVEs

  View on GitHub
  Compiled dataset of Java deserialization CVEs
  ☆60Aug 31, 2020Updated 5 years ago
• potats0 / javaSerializationTools

  View on GitHub
  ☆143Jan 21, 2021Updated 5 years ago
• iSafeBlue / fastjson-autotype-bypass-demo

  View on GitHub
  fastjson 1.2.68 版本 autotype bypass
  ☆142Jun 17, 2022Updated 3 years ago
• lalajun / RMIDeserialize

  View on GitHub
  RMI 反序列化环境 一步步
  ☆213Aug 31, 2020Updated 5 years ago
• jas502n / Security_Article

  View on GitHub
  scrapy website Article and link ...
  ☆15Dec 13, 2020Updated 5 years ago
• Al1ex / CVE-2020-36184

  View on GitHub
  CVE-2020-36184 && Jackson-databind RCE
  ☆15Jan 11, 2021Updated 5 years ago
• shadowsock5 / jackson-databind-POC

  View on GitHub
  ☆19Mar 27, 2020Updated 5 years ago
• ice-doom / codeql_compile

  View on GitHub
  自动反编译闭源应用，创建codeql数据库
  ☆316Mar 2, 2022Updated 4 years ago
• threedr3am / ysoserial

  View on GitHub
  A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.优化了一些东西。
  ☆214Jan 17, 2022Updated 4 years ago
• Litch1-v / ysoserial

  View on GitHub
  A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
  ☆183Apr 23, 2021Updated 4 years ago
• Y4er / javaagent-tomcat-memshell

  View on GitHub
  使用java agent反序列化注入内存shell
  ☆68Sep 30, 2020Updated 5 years ago
• timwhitez / Doge-Defense-Evasion-Ref

  View on GitHub
  Defense Evasion & Bypass AntiVirus reference
  ☆74Mar 28, 2021Updated 4 years ago
• wh1t3p1g / ysomap

  View on GitHub
  A helpful Java Deserialization exploit framework.
  ☆1,240Feb 17, 2025Updated last year
• jas502n / SpringBoot_Actuator_RCE

  View on GitHub
  SpringBoot_Actuator_RCE
  ☆95May 26, 2020Updated 5 years ago
• threedr3am / gadgetinspector

  View on GitHub
  一个利用ASM对字节码进行污点传播分析的静态代码审计应用（添加了大量代码注释，适合大家进行源码学习）。也加入了挖掘Fastjson反序列化gadget chains和SQLInject（JdbcTemplate、MyBatis、JPA、Hibernate、原生jdbc等）静…
  ☆458Mar 24, 2022Updated 3 years ago
• momosecurity / momo-code-sec-inspector-java

  View on GitHub
  IDEA静态代码安全审计及漏洞一键修复插件
  ☆1,047Mar 10, 2022Updated 3 years ago
• jas502n / xxl-job

  View on GitHub
  xxl-job RESTful API RCE
  ☆74Jul 1, 2021Updated 4 years ago
• tongasdp / tongasdp-test

  View on GitHub
  TongASDP漏洞测试环境
  ☆35Mar 22, 2023Updated 2 years ago
• SPuerBRead / Bridge

  View on GitHub
  无回显漏洞测试辅助平台，平台使用Java编写，提供DNSLOG，HTTPLOG等功能，辅助渗透测试过程中无回显漏洞及SSRF等漏洞的验证和利用。
  ☆402Dec 21, 2025Updated 2 months ago
• LoRexxar / log_dependency_checklist

  View on GitHub
  Dependencies with Log4j2 Checklist
  ☆35Dec 14, 2021Updated 4 years ago