Nicky Bloor

SerializationDumper. A tool to dump Java serialization streams in a more human readable form.

BaRMIe. Java RMI enumeration and attack tool.

patch-apk. Wrapper to inject an Objection/Frida gadget into an APK, with support for app bundles/split APKs.

DeserLab. Java deserialization exploitation lab.

SerialBrute. Java serialization brute force attack tool.

PoC. Repo for proof of concept exploits and tools.

xamarin-decompress. Decompress Xamarin .NET compressed binaries so they can be decompiled.

ysoserial. A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

mobileappvm. VM build script for mobile app pentesting/reversing.

CachePlz. Burp Suite extension to fix caching of large static resources returned by badly configured servers/apps.

Middleware-Vulnerability-detection. CVE、CMS、中间件漏洞检测利用合集 Since 2019-9-15

top10webseclist. Top Ten Web Hacking Techniques List

aws-security-cert-service-notes. Security aspects of AWS products for the Security Specialist certification

lynis. Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.

rmiscout. RMIScout uses wordlist and bruteforce strategies to enumerate Java RMI functions and exploit RMI parameter unmarshalling vulnerabilities

objection. 📱 objection - runtime mobile exploration

freddy. Automatically identify deserialisation issues in Java and .NET applications by using active and passive scans

fuzzdb. Automatically exported from code.google.com/p/fuzzdb