abc123info/Struts2VulsScanTools
Some data may be outdated — see provenance labels.
1、点击“检测漏洞”，会自动检测该URL是否存在S2-001、S2-005、S2-009、S2-013、S2-016、S2-019、S2-020/021、S2-032、S2-037、DevMode、S2-045/046、S2-052、S2-048、S2-053、S2-057、S2-061、S2相关log4j2十余种漏洞。 2、“批量验证”，（为防止批量geshell，此功能已经删除，并不再开发）。 3、S2-020、S2-021仅提供漏洞扫描功能，因漏洞利用exp很大几率造成网站访问异常，本程序暂不提供。 4、对于需要登录的页面，请勾选“设置全局Cookie值”，并填好相应的Cookie，程序每次发包都会带上Cookie。 5、作者对不同的struts2漏洞测试语句做了大量修改，执行 observed · 2026-10-06
Health v2 · maintenance only
46/100
- Activity 42
- Release rhythm 36
- Longevity 71
Flags: no_license
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-10-21. Adoption (stars, forks) is never an input.
- gap_med: 60.0
- age_days: 997
- days_rel: 351
- days_push: 351
- n_releases_24m: 3
Adoption not part of the score
1006 stars · 51 forks observed · 2026-10-06
What it is AI-extracted, prompt v1, taxonomy v1, 2026-09-07, confidence 0.95
A Java GUI tool for detecting vulnerabilities in Apache Struts2 web applications, covering over a dozen Struts2 CVEs (S2-001 through S2-061) plus Struts2-related Log4j2 issues. It emphasizes detection and authorized verification rather than exploitation, and supports GET/POST/UPLOAD request methods, custom cookies, HTTP headers, and multiple character encodings.
Use cases
- scan a URL for Struts2 vulnerabilities like S2-045 or S2-061
- check if a Java web app is affected by Log4j2 via Struts2
- verify whether a Struts2 site has debug mode enabled
- test an authenticated page for Struts2 bugs using a session cookie
- detect Struts2 RCE during an authorized penetration test
- help admins confirm and fix Struts2 vulnerabilities
When to choose
- you need to assess a Java web application built on Struts2 for known CVEs
- you want a simple, beginner-friendly GUI scanner for Struts2 flaws during authorized testing
- you need WAF-evading detection payloads and encoding options for Struts2 testing
When to avoid
- your target is not built on the Struts2 framework
- you need automated bulk scanning - batch verification was removed
- you need full exploitation of S2-020/S2-021, which is intentionally not provided
- you require a CLI or CI-integrated scanner - this is a GUI tool
Facets
application · maturity active
penetration-testing vulnerability-scanning security gui security penetration-testing web-development cross-platform jvm windows struts2 java-security vulnerability-detection s2-vulnerabilities log4j2 exploitation-verification red-team macos linux
1 source
- readme: https://github.com/abc123info/Struts2VulsScanTools · fetched 2026-10-06 · eb8dc02c6a07
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| abc123info/Struts2VulsScanTools | main | 46 |
For agents
markdown · JSON · MCP: product_card(name="abc123info/Struts2VulsScanTools")
Data as of 2026-10-19T08:05:51.212177+00:00 · Report a problem