Pinned

1. ysoserial ysoserial Public

   A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

   Java 7.3k 1.7k

2. ciphr ciphr Public

   CLI crypto swiss-army knife for performing and composing encoding, decoding, encryption, decryption, hashing, and other various cryptographic operations on streams of data from the command line; mo…

   Ruby 116 30

3. inspector-gadget inspector-gadget Public

   Primitive tool for exploring/querying Java classes via the Tinkerpop Gremlin graph traversal language

   Java 102 24

4. appseccali-marshalling-pickles appseccali-marshalling-pickles Public

   Slide deck from AppSecCali 2015 Talk "Marshalling Pickles: how deserializing objects will ruin your day"

   CSS 6 5

5. owaspsd-deserialize-my-shorts owaspsd-deserialize-my-shorts Public

   Slide deck from OWASP SD Talk "Deserialize My Shorts: Or How I Learned to Start Worrying and Hate Java Object Deserialization"

   CSS 4 2