A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
- java
- deserialization
- gadget
- exploit
Repository Index
78,850 visible repositories in the index
1–16 of 16 · Most stars
An xposed module that disables SSL certificate checking for the purposes of auditing an app with cert pinning
Allows you to emulate an Android native library, and an experimental iOS emulation
A Simple android remote administration tool using sockets. It uses java on the client side and python on the server side
- android
- backdoor
- python
- reverse-shell
Quickly find differences and similarities in disassembled code
- bindiff
- binexport
- diffing
- program-analysis
This is a tool to repackage apk file, then the apk can load any xposed modules installed in the device. It is another way to hook an app without root device.
- xpatch
- xposed
- hook
- whale
Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)
- android-application
- security-analysis
- dynamic-analysis
- xposed
JNDI注入测试工具（A tool which generates JNDI links can start several servers to exploit JNDI Injection vulnerability,like Jackson,Fastjson,etc）
Java安全相关的漏洞和技术demo，原生Java、Fastjson、Jackson、Hessian2、XML反序列化漏洞利用和Spring、Dubbo、Shiro、CAS、Tomcat、RMI、Nexus等框架\中间件\功能的exploits以及Java Security Manager绕过、Dubbo-Hessian2安全加固等等实践代码。
shiro反序列化漏洞综合利用（仅限授权测试使用）
- shiro
- shiro-security
- shiroexp
- shiro550
KeyStore Explorer is a free GUI replacement for the Java command-line utilities keytool and jarsigner.
Open Adversarial Exposure Validation Platform
- attack-simulation
- breach-simulator
- purple-team
- cybersecurity
AndroRAT | Remote Administrator Tool for Android OS Hacking
- the404hacking
- rat
- remote
- administrator
Ephemeral root via the CVE-2026-43284 page-cache exploit
- android
- android-root
- android-security
- cve-2026-43284
Procyon is a suite of Java metaprogramming tools, including a rich reflection API, a LINQ-inspired expression tree API for runtime code generation, and a Java decompiler.
Ephemeral root via the CVE-2026-43284 page-cache exploit