GitHub - RASSec/learnjavabug at 4588d3eda84b71a5909faca4fb54eaca2c03456b

RASSec / learnjavabug Public

forked from threedr3am/learnjavabug

Notifications You must be signed in to change notification settings
Fork 0
Star 0

Java安全相关的漏洞和技术demo，其中包括原生Java、Fastjson、Jackson、Hessian2以及XML反序列化漏洞利用和Dubbo（Hessian2反序列化）、Shiro（PaddingOracleCBC）等框架的exploits，并且还有Java Security Manager绕过等等实践代码。

0 stars 496 forks Branches Tags Activity

Star

Notifications

Branches Tags

Name		Name	Last commit message	Last commit date
Latest commit History 22 Commits
src		src
.gitignore		.gitignore
README.md		README.md
a.obj		a.obj
pom.xml		pom.xml

Repository files navigation

fastjson poc

com.threedr3am.bug.fastjson.FastjsonSerialize 利用条件：fastjson <= 1.2.24 + Feature.SupportNonPublicField
com.threedr3am.bug.fastjson.NoNeedAutoTypePoc 利用条件：fastjson < 1.2.48 不需要任何配置，默认配置通杀RCE

Padding Oracle CBC

com.threedr3am.bug.paddingoraclecbc.PaddingOracleCBC java实现padding oracle cbc
com.threedr3am.bug.paddingoraclecbc.PaddingOracleCBC2 多组的java实现padding oracle cbc