Michael Stepankin

hestia. Hestia scrapes real estate websites for new rental listings

hack-fastjson-1.2.80.

burp-auto-drop. Burp extension to automatically drop requests that match a certain regex.

cve. Gather and update all available and newest CVEs with their PoC.

jwt-editor. A Burp Suite extension and standalone application for creating and editing JSON Web Tokens. This tool supports signing and verification of JWS, encryption and decryption of JWE and automation of several well-known attacks against applications that consume JWT.

OAUTHScan. Burp Suite Extension useful to verify OAUTHv2 and OpenID security

solr-injection. Apache Solr Injection Research

BurpCustomizer. Because just a dark theme wasn't enough!

Spring-Boot-Vulnerability.

client-side-prototype-pollution. Prototype Pollution and useful Script Gadgets

spring-view-manipulation. When MVC magic turns black

websocket-smuggle. Issues with WebSocket reverse proxying allowing to smuggle HTTP requests

SpringBootVulExploit. SpringBoot 相关漏洞学习资料，利用方法和技巧合集，黑盒安全评估 check list

gixy. Nginx configuration static analyzer

oauth. 🔗 OAuth 2.0 implementation for various providers in one place.

jvmxray. Externalize Java application access to protected resources as log messages.

fuzz.txt. Potentially dangerous files

weird_proxies. Reverse proxies cheatsheet

orangetsai-springboot-actuator-poc. Java

CVE-2019-7238. 🐱‍💻 Poc of CVE-2019-7238 - Nexus Repository Manager 3 Remote Code Execution 🐱‍💻

CVE-2019-11708. Full exploit chain (CVE-2019-11708 & CVE-2019-9810) against Firefox on Windows 64-bit.

java-sec-code. Java web common vulnerabilities and security code which is base on springboot and spring security

solr_rce. Apache Solr RCE via Velocity template

rogue-jndi. A malicious LDAP server for JNDI injection attacks

BaRMIe. Java RMI enumeration and attack tool.

mySapAdventures. A quick methodology on testing / hacking SAP Applications for n00bz and bug bounty hunters

jmet. Java Message Exploitation Tool

DupeKeyInjector. DupeKeyInjector

ysoserial.net. Deserialization payload generator for a variety of .NET formatters

Java-Deserialization-Cheat-Sheet. The cheat sheet about Java Deserialization vulnerabilities

JNDI-Exploit-Bypass-Demo. Demo code for post <Restrictions of JNDI Manipulation RCE & Bypass>

puppeteer. JavaScript API for Chrome and Firefox

websitesVulnerableToSSTI. Simple websites vulnerable to Server Side Template Injections(SSTI)

tplmap. Server-Side Template Injection and Code Injection Detection and Exploitation Tool

serianalyzer. A static byte code analyzer for Java deserialization gadget research

marshalsec. Java

ysoserial. A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.