feihong-cs/ShiroExploit-Deprecated

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1956 stars · 295 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Java-based one-click exploitation tool for Apache Shiro vulnerabilities Shiro550 (hardcoded key) and Shiro721 (Padding Oracle), supporting multiple detection methods (ceye.io, dnslog.cn, JRMP) and response echo techniques. It can detect vulnerable keys/gadgets, execute commands, obtain reverse shells, and write webshells.

Use cases

• detect shiro rememberme deserialization vulnerability
• exploit shiro550 hardcoded key
• exploit shiro721 padding oracle attack
• get reverse shell from shiro vulnerability
• test web app for shiro deserialization rce
• write webshell via shiro exploit

When to choose

• you need a GUI-driven one-click tool to test Shiro550/Shiro721 on a target
• you want multiple out-of-band detection options (dnslog, ceye, JRMP) and echo methods
• you are doing authorized penetration testing of Java web apps using Apache Shiro

When to avoid

• the project is deprecated by its own author and no longer maintained
• you need modern memory-shell injection or the latest gadget/echo support - use newer tools
• you want a supported or licensed tool for production security workflows

Facets

cli-tool · maturity abandoned

penetration-testing security vulnerability-scanning security penetration-testing developer-tools jvm cross-platform shiro shiro550 shiro721 deserialization exploit-tool red-team java-security

Member repositories

For agents

markdown · JSON · MCP: product_card(name="feihong-cs/ShiroExploit-Deprecated")