wyzxxz/shiro_rce_tool

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1594 stars · 181 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Java-based command-line tool that assists in detecting and exploiting Apache Shiro rememberMe deserialization vulnerabilities. It brute-forces shiro keys, tests gadget chains (CommonsCollections, CommonsBeanutils, Spring, Groovy, etc.), and supports command execution with out-of-band detection and response echo.

Use cases

• detect if a target uses Apache Shiro
• brute-force shiro rememberMe encryption keys
• test which deserialization gadget chains work on a target
• execute commands on an authorized shiro-vulnerable host
• batch scan multiple URLs for shiro vulnerabilities
• test targets that do not have outbound network access

When to choose

• you are an authorized security tester auditing Java apps for shiro deserialization RCE
• you need an all-in-one key-guessing and gadget-chain testing tool
• you need batch detection of shiro across many URLs

When to avoid

• you have no authorization to test the target
• the target does not use Apache Shiro
• you need a general-purpose vulnerability scanner beyond shiro deserialization

Facets

cli-tool · maturity maintenance

security penetration-testing vulnerability-scanning security penetration-testing cli jvm cross-platform shiro deserialization rce java-security exploitation pentest

Member repositories

For agents

markdown · JSON · MCP: product_card(name="wyzxxz/shiro_rce_tool")