PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

RMIScout: Safely and Quickly Brute-Force Java RMI Interfaces for Code Execution

bishopfox.com | blog | #java | #deserialization | #penetration-testing | #brute-force | #rmi | #tool
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox's open source RMIScout safely brute-forces exposed Java RMI interfaces to guess method signatures without invocation, exposing deserialization-based code execution vectors.
Published
Collected

Related coverage

Critical · vulnerability · github.com
Log4j FilteredObjectInputStream Bypass: Pre-auth RCE via MarshalledObject
This PoC demonstrates an unexpected filter-bypass gadget in Log4j 2, emphasizing the danger of unauthenticated serialized object ingestion.
vulnerability · hacktron.ai
Pre-Auth RCE in OpenAM via jato.clientSession (CVE-2026-33439)
Hacktron AI discovers a critical pre-authentication RCE in OpenAM through a forgotten deserialization parameter that the original CVE-2021-35464 fix missed.
vulnerability · blog.viettelcybersecurity.com
[CVE-2013-2165] When EL Injection meets Java Deserialization
Exploit development for RichFaces 4 CVE-2018-12532, chaining EL injection into Java deserialization and bypassing library restrictions to achieve reliable RCE on JSF applications.
blog · bishopfox.com
Unified Code, Unified Risks: Uncovering Vulnerabilities in .NET MAUI Applications
Bishop Fox shows how to bypass .NET MAUI's platform packaging to extract readable C# assemblies from Android and iOS apps, then use that shared-assembly insight to uncover critical vulnerability patterns in common business logic.
blog · bishopfox.com
Lessons Learned on Brute-forcing RMI-IIOP With RMIScout
RMIScout 1.4 adds RMI-IIOP support, SSL, invoke and list modes, and a localhost bypass for attacking exposed Java RMI interfaces — plus notes on brute-forcing RMI-IIOP method signatures.
blog · bishopfox.com
Why You Need IDontSpeakSSL in Your Life
Why Bishop Fox built IDontSpeakSSL: a Python 3 wrapper that parallelizes testssl.sh scans and produces HTML reports of bad TLS configurations for large network pentests.
Back