joaomatosf/jexboss

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

2518 stars · 641 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

JexBoss is a Python command-line tool for testing and exploiting JBoss Application Server and Java deserialization vulnerabilities. It supports multiple exploitation vectors such as jmx-console, web-console invokers, and RMI over HTTP across JBoss versions 3-6.

Use cases

• test jboss server for known vulnerabilities
• exploit java deserialization vulnerabilities
• verify jmx-console exposure on a jboss server
• get a reverse shell from a vulnerable java application
• scan a host for jboss admin-console and invoker endpoints
• check jenkins CLI RCE and remote JMX CVEs

When to choose

• you are doing authorized penetration testing against JBoss or legacy Java applications
• you need a ready-made exploit tool for Java deserialization gadget chains
• you want to verify whether a JBoss instance is vulnerable before remediation

When to avoid

• you need a general-purpose vulnerability scanner rather than targeted JBoss/Java exploits
• your environment requires Python 3 only, since the tool targets Python 2.7
• you want actively maintained tooling - the last release was in 2020

Facets

cli-tool · maturity maintenance

penetration-testing security cli security penetration-testing developer-tools windows python cli exploitation java-deserialization jboss reverse-shell vulnerability-scanning red-team linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="joaomatosf/jexboss")