Shiro Security Framework: Authentication and Authorization
Apache Shiro is a powerful and flexible security framework that provides robust authentication and authorization capabilities for Java applications.
Shiro Core Architecture
Subject: Represents the "current user" or actor interacting with the system. This can be a human user, a remote service, or any entity requiring security.
Securit ...
Posted on Sun, 30 Aug 2026 16:47:32 +0000 by g00fy_m
Shiro 550 Deserialization Vulnerability Analysis and Exploitation Techniques
Understanding the Shiro Framework 550 Deserialization Vulnerability
Environment Setup
Required components: Shiro source code, JDK 8, Tomcat
Vulnerability Root Cause
The vulnerability affects Shiro versions <= 1.2.24, though higher vertions may also be vulnerable if developers configure hardcoded keys. The security flaw exists in the Remember ...
Posted on Thu, 30 Jul 2026 17:02:25 +0000 by railanc4309
Exploiting Shiro RememberMe Deserialization for Webshell Creation
Exploiting Shiro RememberMe Deserialization for Webshell Creation
Modifying ysoserial for Java Code Execution Payloads
The default implementation in ysoserial can be enhanced to support direct Java code execution. Below is the modified code that checks if the command parameter starts with "code:" to determine whether to execute a system comma ...
Posted on Sun, 26 Jul 2026 16:34:58 +0000 by philweb