safe6Sec/Fastjson resource

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1860 stars · 355 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A curated collection of Fastjson exploitation techniques, payloads, and fingerprinting tricks for Java JSON deserialization vulnerabilities. It covers identifying whether a target uses Fastjson, distinguishing it from other JSON libraries, and probing library versions.

Use cases

• detect if a Java service uses fastjson
• fingerprint fastjson version on a target
• find deserialization payloads for fastjson
• distinguish jackson from fastjson in blind responses
• learn fastjson deserialization attack techniques
• reproduce fastjson vulnerabilities across versions

When to choose

• you are doing authorized penetration testing or security research on Java applications using Fastjson
• you need a reference of version-specific Fastjson payloads and detection methods

When to avoid

• you need a JSON parsing library for your own application - use the official Fastjson or Jackson instead
• you want a scanning tool rather than a manual payload reference
• your use of these techniques is not authorized by the target's owner

Facets

learning-resource · maturity active

security penetration-testing vulnerability-scanning developer-tools security penetration-testing developer-tools apis cross-platform cli fastjson java-deserialization payload-cheatsheet rce json-parsing exploitation-techniques security-notes

Member repositories

For agents

markdown · JSON · MCP: product_card(name="safe6Sec/Fastjson")