This is an Exploit App I made when solving the DocumentViewer challenge (CVE-2021-40724) from MobileHackingLab. It will download a libdocviewe_pro.so library from your local machine unto the vulnerable app's internal storage, load it upon relaunch and achieve an RCE.

An unfinished RCE framework for Netty & Bukkit applications

spring-cloud-function SpEL RCE复现环境Config files for my GitHub profile.

Analysis of the Jackson Databind CVE's

Little recap of the log4j2 remote code execution (CVE-2021-44228)

RCE using Minecraft Mod

Java General Vulnerable Web Application

Educational Minecraft plugin demonstrating the dangers of installing unverified plugins.

Minecraft server test remote code execution by calling log4j in chat (CVE-2021-44228)

POC

Security Research and PoC

Possible RCE Solution when performing file upload based on Jakarta Multipart parser (Filter Approach)

Apache Log4j2 RCE( CVE-2021-44228)验证环境

POC for Infamous Log4j CVE-2021-44228

JNDI-Injection-Exploit 是一个用于生成可用 JNDI 链接并提供后台服务的工具，支持启动 RMI 服务器、LDAP 服务器和 HTTP 服务器。其 RMI 和 LDAP 服务基于 marshalsec，并进行修改以与 HTTP 服务联动。

Automatically search for the required class and package it as a jar Create One Min Jar file

xmlrpc common deserialization vulnerability

CVE-2020-11113:Jackson-databind RCE

MicroRASP，用Bytebuddy实现的轻量级java rasp框架，覆盖多版本jdk与中间件🔥

CVE-2019-12814:Jackson JDOM XSLTransformer Gadget