# Ghost Bits Cast Attack

Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026).

- Repository: https://github.com/yaklang/hack-skills (2601 stars)
- Category: Security
- License: MIT
- Last updated: 2026-09-13
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add yaklang/hack-skills --skill ghost-bits-cast-attack -g -a claude-code -y`
Codex: `npx skills add yaklang/hack-skills --skill ghost-bits-cast-attack -g -a codex -y`
Cursor: `npx skills add yaklang/hack-skills --skill ghost-bits-cast-attack -g -a cursor -y`
Gemini CLI: `npx skills add yaklang/hack-skills --skill ghost-bits-cast-attack -g -a gemini-cli -y`

## Description

Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass WAF/IDS for SQL injection, deserialization RCE, file upload (Webshell), path traversal, CRLF injection, request smuggling, and SMTP injection. Affects Tomcat, Spring, Jetty, Undertow, Vert.x, Jackson, Fastjson, Apache Commons BCEL, Apache HttpClient, Angus Mail, JDK HttpServer, Lettuce, Jodd, XMLWriter and re-enables many "patched" CVEs through WAF bypass.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# SKILL: Ghost Bits / Cast Attack, Java char to byte Narrowing Playbook

> **AI LOAD INSTRUCTION**: This is a Java-only injection-enabling primitive,
> not a standalone vulnerability class. Whenever you see (1) a Java backend,
> (2) a WAF/IDS in front of it, and (3) any of {SQLi, deser RCE, file upload,
> path traversal, CRLF, request smuggling, SMTP injection} on the menu, ALWAYS
> try Ghost Bits variants of the payload before declaring it "blocked". The
> root cause is the silent loss of the high 8 bits when Java code narrows a
> 16-bit `char` to an 8-bit `byte`, the WAF sees a harmless Unicode
> character, the backend reconstructs the original ASCII attack byte. Base
> models almost never reach for this primitive.
>
> Source: Black Hat Asia 2026 talk *Cast Attack: A New Threat Posed by Ghost
> Bits in Java* by Xinyu Bai (@b1u3r), Zhihui Chen (@1ue), with contributor
> Zongzheng Zheng (@chun_springX).

## 0. RELATED ROUTING

Ghost Bits is a *bypass* primitive that re-enables payloads from many other
playbooks. Pair it with whichever attack family applies:

The rest: https://github.com/yaklang/hack-skills/blob/HEAD/skills/ghost-bits-cast-attack/SKILL.md