X1r0z

JNDIMap. A powerful JNDI injection exploitation framework that supports RMI, LDAP and LDAPS protocols, including various bypass methods for high-version JDK restrictions

Godzilla-Suo5MemShell. 使用 Godzilla 一键注入 Suo5 内存马

ActiveMQ-RCE. ActiveMQ RCE (CVE-2023-46604) 漏洞利用工具

frp. 基于原版 frp 二开, 添加了一些小功能

EBurstGo. 利用 Exchange 服务器 Web 接口爆破邮箱账户 | Brute force email accounts using Exchange server web endpoints

pivot-rs. A lightweight port-forwarding and socks proxy tool written in Rust 🦀

cpploader. c++ shellcode loader

hacking-espresso. Hacking GraalVM Espresso - Abusing Continuation API to Make ROP-like Attack

dubbo-rce. PoC of Apache Dubbo CVE-2023-23638

jetty-fuzz. Java

hessian-overlong-encoding. Hessian UTF-8 Overlong Encoding

ClassNameObfuscator. 基于多种策略, 对已有 JAR 包中的全限定类名进行变换, 无限生成高度相似的虚假类名

presentations. My presentation slides

go-ntlmssp. NTLM/Negotiate authentication over HTTP that supports Pass The Hash Mode (PtH)

spring-amqp-deserialization. PoC of Spring AMQP Deserialization Vulnerability (CVE-2023-34050)

memshell-killer. A command-line tool for Java Web memory shell incident response

dork. dork everything

nacos-hessian-rce. PoC of Nacos JRaft Hessian RCE

oss-security-bot. oss-security mailing list Webhook Bot, using LLM for summarization, written in Rust 🦀

X1r0z. Profile

memshell-killer-web. TypeScript

webscan. Find the same IP site

dotfiles. Vim Script

MirrorScan. bugscan scanner