Auditing JDBC Drivers at Scale with Hacktron CLI

Bishop Fox's open source RMIScout safely brute-forces exposed Java RMI interfaces to guess method signatures without invocation, exposing deserialization-based code execution vectors.

Bishop Fox's GadgetProbe probes Java deserialization endpoints to enumerate classes and library versions on the remote classpath, helping testers build payloads when ysoserial chains fail blind.

GitLab tutorial on modernizing Java 8 to 21 with Cursor: fix one failing E2E test, add quality gates, then migrate HTTP connection handling, with GitLab MCP and Duo Agent Platform review evidence.

Broken access control often slips past dynamic testing. This article shows how secure code review of Spring annotations, expressions, and filters surfaces Java Spring privilege escalation paths early.

Wiz Threat Research examines Spring Boot Actuator misconfigurations that leak credentials and API keys—and can enable RCE—found in one in four environments with exposed endpoints.

The initial primitive gained from the vulnerability is an absolute address dereference in which the read value is afterwards used as an ObjC object. As such, some knowledge of the target address space is required in order to exploit this vulnerability for remote code execution. This blog post describes a way to defeat ASLR remotely without any additional information disclosure vulnerabilities.