The cheat sheet about Java Deserialization vulnerabilities
-
Updated
May 26, 2023
#
java-deserialization
Here are 15 public repositories matching this topic...
A helpful Java Deserialization exploit framework.
-
Updated
Feb 17, 2025 - Java
Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.
-
Updated
Mar 4, 2021 - Java
RMIScout uses wordlist and bruteforce strategies to enumerate Java RMI functions and exploit RMI parameter unmarshalling vulnerabilities
-
Updated
Sep 7, 2022 - Java
xmind\code\articles for my personal blog 个人博客上的资源备份存储，也是个人分享的汇总
-
Updated
Apr 19, 2023 - Python
Compiled dataset of Java deserialization CVEs
-
Updated
Aug 31, 2020
Library for manually creating Java serialization data.
-
Updated
Oct 23, 2026 - Java
First publicly shared exploit implementation for CVE-2026-33439 (OpenAM pre-auth RCE via jato.clientSession deserialization).
-
Updated
May 1, 2026 - Python
Python PoC for CVE-2026-33439, an OpenAM pre-authentication RCE via jato.clientSession deserialization
python proof-of-concept openam java-deserialization security-research remote-code-execution cve-2026-33439
-
Updated
Sep 12, 2026 - Python
Java deserialization tool for creating encrypted and HMAC protected payloads.
-
Updated
Mar 23, 2019 - Python
maptool unauthenticated rce exploit <1.8.0 beta2b
-
Updated
Feb 10, 2021 - Python
Enhanced fork of JexBoss, Apache 2.0, with a Shodan driven bulk scan mode, quiet mode and live progress bar. Authorized and educational use only.
shodan penetration-testing jboss offensive-security red-team security-tools java-deserialization apache-2 exploitation-tool jexboss
-
Updated
Jul 27, 2026 - Python
反序列化漏洞工具箱 - GUI toolkit for Java deserialization vulnerability research: detection and exploitation for Shiro, Fastjson, XStream, Spring Boot Actuator, with built-in JNDI server, reverse-shell management and webshell dropper. For authorized security testing only.
xstream deserialization penetration-testing shiro spring-boot-actuator fastjson java-deserialization security-research ysoserial
-
Updated
Oct 20, 2026 - Python
Add this topic to your repo
To associate your repository with the java-deserialization topic, visit your repo's landing page and select "manage topics."