RMIScout, performs wordlist and brute-force attacks against exposed Java RMI interfaces to safely guess method signatures without invocation. This technique is powerful and quick, allowing approximately 2,500 signature guesses per second. Identified signatures with non-primitive parameters are often exploitable deserialization vectors, so this can lead to a high-impact finding during an assessment.
8240 S. Kyrene Rd.
Suite A113
Tempe, AZ
85284
United States