Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

RMIScout: Safely and Quickly Brute-Force Java RMI Interfaces for Code Execution

bishopfox.com | blog | #java | #deserialization | #penetration-testing | #brute-force | #rmi | #tool

Summary

Bishop Fox's open source RMIScout safely brute-forces exposed Java RMI interfaces to guess method signatures without invocation, exposing deserialization-based code execution vectors.
Published
Collected

original ↗

Related coverage

  1. GadgetProbe: Exploiting Deserialization to Brute-Force the Remote Classpath (bishopfox.com)
  2. Log4j FilteredObjectInputStream Bypass: Pre-auth RCE via MarshalledObject (github.com)
  3. Power Up Your Pen Tests: Creating Burp Suite Extensions with the New Montoya API (bishopfox.com)
  4. Lessons Learned on Brute-forcing RMI-IIOP With RMIScout (bishopfox.com)
  5. Introducing cyber.dic (bishopfox.com)
  6. Why You Need IDontSpeakSSL in Your Life (bishopfox.com)

back