That repository contains my updates to the well know java deserialization exploitation tool ysoserial.
☆189May 15, 2022Updated 4 years ago
Alternatives and similar repositories for ysoserial-modified
Users that are interested in ysoserial-modified are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- This script implements the Proof of Concept attack from the Checkpoint research "NTLM Credentials Theft via PDF Files"☆29May 1, 2018Updated 8 years ago
- WebLogic Insecure Deserialization - CVE-2019-2725 payload builder & exploit☆52Sep 26, 2019Updated 6 years ago
- JNDI-Exploitation-Kit（A modified version of the great JNDI-Injection-Exploit created by @welk1n. This tool can be used to start an HTTP S…☆940Sep 2, 2025Updated 9 months ago
- ☆16Dec 15, 2021Updated 4 years ago
- CVE-2017-10366: Oracle PeopleSoft 8.54, 8.55, 8.56 Java deserialization exploit☆25Sep 4, 2018Updated 7 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Some payloads of JNDI Injection in JDK 1.8.0_191+☆484Dec 9, 2020Updated 5 years ago
- Native Java-based deserialization exploit for WebLogic T3 (and T3S) listeners.☆34Mar 2, 2020Updated 6 years ago
- Directory/File, DNS and VHost busting tool written in Go☆25Jan 3, 2020Updated 6 years ago
- X-Platform bind shell in TypeScript!☆30Jul 11, 2025Updated 11 months ago
- Slides/Demos from the BSides Munich 2019 talk "Attacking Java RMI in 2019"☆101Sep 20, 2019Updated 6 years ago
- POC tools for exploring SMB over QUIC protocol☆132Apr 6, 2022Updated 4 years ago
- ☆20Apr 21, 2020Updated 6 years ago
- RMIScout uses wordlist and bruteforce strategies to enumerate Java RMI functions and exploit RMI parameter unmarshalling vulnerabilities☆449Sep 7, 2022Updated 3 years ago
- Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.☆616Mar 4, 2021Updated 5 years ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Deserialization payload generator for a variety of .NET formatters☆3,734Jun 11, 2026Updated last week
- cve-2020-0688☆326Jul 4, 2023Updated 2 years ago
- Golang PoC that sandboxes Defender (or other PPL) by setting its token integrity to Untrusted.☆14May 28, 2025Updated last year
- ☆668Nov 17, 2021Updated 4 years ago
- libssh CVE-2018-10933☆22Oct 20, 2018Updated 7 years ago
- Framework for Kerberos relaying☆950May 29, 2022Updated 4 years ago
- The cheat sheet about Java Deserialization vulnerabilities☆3,177May 26, 2023Updated 3 years ago
- miscellaneous security research stuff☆37Jul 16, 2019Updated 6 years ago
- List DTDs and generate XXE payloads using those local DTDs.☆661Feb 21, 2024Updated 2 years ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- A proof of concept for Metasploit's CVE-2019-5624 vulnerability (Rubyzip insecure ZIP handling RCE)☆13May 2, 2019Updated 7 years ago
- A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.☆8,919Dec 4, 2025Updated 6 months ago
- Native Java serialization filter blacklist for common gadgets☆20Sep 12, 2019Updated 6 years ago
- This is a weaponized WSUS exploit☆299Nov 25, 2022Updated 3 years ago
- Java serialization brute force attack tool.☆124Aug 18, 2017Updated 8 years ago
- FrostByte is a POC project that combines different defense evasion techniques to build better redteam payloads☆385Apr 16, 2022Updated 4 years ago
- Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user☆1,059Jul 10, 2022Updated 3 years ago
- A collection of curated Java Deserialization Exploits☆594May 16, 2021Updated 5 years ago
- win32k LPE☆462Jan 27, 2022Updated 4 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- JRE8u20_RCE_Gadget☆255Jul 1, 2016Updated 9 years ago
- All about CVE-2018-14667; From what it is to how to successfully exploit it.☆50Nov 30, 2018Updated 7 years ago
- JMX enumeration and attacking tool.☆505Jun 26, 2025Updated 11 months ago
- PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.☆2,241Aug 15, 2024Updated last year
- Notes about attacking Jenkins servers☆2,099Jul 10, 2024Updated last year
- MOGWAI LABS JMX exploitation toolkit☆207Mar 13, 2023Updated 3 years ago
- CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter.☆1,403Dec 16, 2021Updated 4 years ago