pureqh/Hyacinth

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1144 stars · 75 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Hyacinth is a Java-based GUI tool that bundles detection and exploitation modules for common Java vulnerabilities such as Struts2, Fast, Weblogic, Shiro, Log4j, JBoss, and SpringCloud. It also includes a webshell generation module (Bypass) with payload obfuscation for WAF evasion, designed for red team and attack-defense exercises.

Use cases

• detect and exploit java deserialization vulnerabilities
• brute force shiro keys
• generate obfuscated webshells to bypass waf
• test struts2 and fast vulnerabilities
• consolidate multiple exploit jars into one gui tool
• red team attack-defense exercise toolkit

When to choose

• you need an all-in-one GUI for common Java vulnerability exploitation during authorized penetration tests
• you want payload obfuscation to evade WAFs
• you work on Windows or macOS and want a ready-to-run jar

When to avoid

• you need a stable, licensed, production security product
• you require support for very recent JDK runtimes without quirks
• you need automated CI-based vulnerability scanning rather than manual exploitation

Facets

application · maturity active

penetration-testing security gui security penetration-testing developer-tools windows jvm cross-platform vulnerability-exploitation red-team webshell-generator waf-bypass java-deserialization macos desktop

Member repositories

For agents

markdown · JSON · MCP: product_card(name="pureqh/Hyacinth")