The cheat sheet about Java Deserialization vulnerabilities

pentesting javadeser java-deserialization

• Updated May 26, 2023

A helpful Java Deserialization exploit framework.

exploitation-framework java-deserialization

• Updated Feb 17, 2025
• Java

Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.

java pentesting javassist security-tools burp-extensions java-deserialization pentest-tools

• Updated Mar 4, 2021
• Java

RMIScout uses wordlist and bruteforce strategies to enumerate Java RMI functions and exploit RMI parameter unmarshalling vulnerabilities

java scanner javassist offensive-security java-rmi security-tools java-deserialization

• Updated Sep 7, 2022
• Java

xmind\code\articles for my personal blog 个人博客上的资源备份存储，也是个人分享的汇总

blog share article code blogpost static-site mindmap xmind java-deserialization arcticle

• Updated Apr 19, 2023
• Python

Compiled dataset of Java deserialization CVEs

security deserialization cve java-deserialization

• Updated Aug 31, 2020

an Evil Java RMI Registry.

rmi-registry java-deserialization

• Updated Feb 8, 2023
• Ruby

Library for manually creating Java serialization data.

serialization javadeser java-deserialization java-serialization

• Updated Oct 23, 2026
• Java

deserialization penetration-testing jwt-token application-security pentesting pentest blind-sql-injection jwtauth java-deserialization deserialization-vulnerability redteam redteam-infrastructure

• Updated Dec 8, 2022

First publicly shared exploit implementation for CVE-2026-33439 (OpenAM pre-auth RCE via jato.clientSession deserialization).

exploit java-deserialization cve-2026-33439

• Updated May 1, 2026
• Python

Python PoC for CVE-2026-33439, an OpenAM pre-authentication RCE via jato.clientSession deserialization

python proof-of-concept openam java-deserialization security-research remote-code-execution cve-2026-33439

• Updated Sep 12, 2026
• Python

Java deserialization tool for creating encrypted and HMAC protected payloads.

deserialization java-deserialization security-testing web-testing

• Updated Mar 23, 2019
• Python

maptool unauthenticated rce exploit <1.8.0 beta2b

exploit rce hessian maptool java-deserialization deserialization-vulnerability

• Updated Feb 10, 2021
• Python

Enhanced fork of JexBoss, Apache 2.0, with a Shodan driven bulk scan mode, quiet mode and live progress bar. Authorized and educational use only.

shodan penetration-testing jboss offensive-security red-team security-tools java-deserialization apache-2 exploitation-tool jexboss

• Updated Jul 27, 2026
• Python

反序列化漏洞工具箱 - GUI toolkit for Java deserialization vulnerability research: detection and exploitation for Shiro, Fastjson, XStream, Spring Boot Actuator, with built-in JNDI server, reverse-shell management and webshell dropper. For authorized security testing only.

xstream deserialization penetration-testing shiro spring-boot-actuator fastjson java-deserialization security-research ysoserial

• Updated Oct 20, 2026
• Python