SummerSec/ShiroAttack2

Health v2 · maintenance only

Adoption not part of the score

2619 stars · 290 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Java-based exploitation tool for the Apache Shiro-550 rememberMe deserialization vulnerability, offering both a JavaFX GUI and a CLI. It detects Shiro targets, brute-forces AES keys, executes commands via gadget chains, injects memshells, and replaces target keys, intended only for authorized testing.

Use cases

• detect whether a target web app uses Apache Shiro
• brute-force or verify the Shiro rememberMe AES key
• execute OS commands on an authorized Shiro-550 target
• inject a memshell like Godzilla or Behinder into a Shiro app
• replace a target's Shiro AES key to invalidate old ones
• script Shiro exploitation in CI or AI agent workflows with JSON output

When to choose

• you are doing authorized penetration testing against Shiro-550 targets
• you need both GUI and scriptable CLI exploitation of Shiro deserialization
• you want automatic gadget chain detection without commons-collections dependencies

When to avoid

• you lack explicit authorization to test the target
• you need a general-purpose vulnerability scanner rather than a Shiro-specific exploit tool
• your target runs a patched Shiro version with a strong random key

Facets

cli-tool · maturity active

penetration-testing security cli security penetration-testing cross-platform jvm cli shiro shiro-550 deserialization exploitation memshell java-security red-team authorized-testing

Member repositories

For agents

markdown · JSON · MCP: product_card(name="SummerSec/ShiroAttack2")