ghost-bits-cast-attack

ghost-bits-cast-attack is an offensive-security playbook documenting the Java "Ghost Bits" / Cast Attack technique presented at Black Hat Asia 2026. Its core primitive abuses the silent loss of the high 8 bits when Java code narrows a 16-bit char to an 8-bit byte: a WAF or IDS inspects a harmless-looking Unicode character while the backend reconstructs the original ASCII attack byte, re-enabling payloads a security filter would otherwise block.

The skill is a bypass primitive rather than a standalone vulnerability class. It packages routing guidance and payload variants for pairing the narrowing trick with common attack families — injection, deserialization RCE, file-upload webshells, path traversal, CRLF injection, HTTP request smuggling, and SMTP injection — and calls out affected components such as Tomcat, Spring, Jetty, Undertow, Vert.x, Jackson, Fastjson, Apache Commons BCEL, Apache HttpClient, Angus Mail, JDK HttpServer, Lettuce, Jodd, and XMLWriter. A companion cookbook collects concrete transformation recipes.

It is intended for authorized red-team engagements, penetration testing, and defensive research where testers must verify whether a Java stack behind a WAF is vulnerable to char-to-byte narrowing. Because it contains working exploitation payloads and is explicitly designed to defeat security controls, it should only ever be used against systems you have explicit written permission to test.