Chris Frohoff frohoff

Pinned

1. ysoserial

   A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

   Java 3.2k 926

2. ciphr

   CLI crypto swiss-army knife for performing and composing encoding, decoding, encryption, decryption, hashing, and other various cryptographic operations on streams of data from the command line; mo…

   Ruby 86 26

3. inspector-gadget

   Primitive tool for exploring/querying Java classes via the Tinkerpop Gremlin graph traversal language

   Java 74 18

4. appseccali-marshalling-pickles

   Slide deck from AppSecCali 2015 Talk "Marshalling Pickles: how deserializing objects will ruin your day"

   CSS 5 4

5. owaspsd-deserialize-my-shorts

   Slide deck from OWASP SD Talk "Deserialize My Shorts: Or How I Learned to Start Worrying and Hate Java Object Deserialization"

   CSS 3