What problem does it solve?
Individual medium or low-severity findings from a Java white-box audit often look harmless in isolation, but combining them can produce Critical-level attack paths. This Skill provides a structured methodology for chaining discovered vulnerabilities, auditing Maven/Gradle dependencies for exploitable CVEs, and analyzing deserialization gadget chains so audit results reflect real-world impact.
Core Features & Use Cases
- Three-Stage Chain Assembly: Classify findings into INFO, AUTH, and EXEC stages, then validate that each stage's output satisfies the next stage's preconditions with evidence (EVID) requirements.
- Dependency CVE Auditing: Extract Maven/Gradle dependency trees, cross-reference NVD and GitHub Advisory, and apply a three-step exploitability check (version match, reachable code path, exposed attack surface).
- Gadget Chain Analysis: Match classpath dependencies against ysoserial payloads, plan marshalsec JNDI exploitation with JDK version constraints, and discover custom gadgets in project code.
- Use Case: During a Spring Boot audit you find an exposed Actuator endpoint and JWT authentication. Use this Skill to chain information disclosure to JWT forgery to admin RCE, then score the chain with the feasibility coefficient formula.
Quick Start
Analyze the vulnerabilities found in my Java audit and assemble them into scored exploit chains with evidence for each step.
