ghost-bits-cast-attack

Guides testing of Java services for character-to-byte narrowing that can bypass input filters and enable injection.

When to use it

Use when a Java backend has a WAF, IDS, or input filter blocking a literal injection payload.

Give it a Java service to test; it compares Unicode and literal-byte requests to identify character-narrowing sinks.