Comprehensive exploitation of Shiro deserialization vulnerabilities (for authorized testing only)
ShiroAttack2 is a security-testing tool for detecting and exploiting the Shiro-550 deserialization vulnerability in Apache Shiro applications. Authorized security testers use its command-line and JavaFX interfaces to test targets, validate keys, execute commands, and perform related post-exploitation actions. The catalogue entries include instructions, a plugin, and a skill for operating the tool.
This repository also configures its own agents. See what ShiroAttack2 tells them →
Plugin Claude Code
Bundles 1 skill · 134 tokens together
A security testing tool for Apache Shiro, a Java framework used for user login and access control. It covers Shiro-550 vulnerability testing, including key guessing, gadget-chain detection, command execution, memory-shell injection, and key changes.