Skip to content

Commit 9b02e2e

Browse files
0e0w0e0w
committed
Update README.md
1 parent 25cccfc commit 9b02e2e

File tree

1 file changed

+79
-78
lines changed

1 file changed

+79
-78
lines changed

‎README.md

Lines changed: 79 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -2,22 +2,21 @@
22

33
![HackJava](https://socialify.git.ci/HackJava/HackJava/image?description=0&descriptionEditable=%E3%80%8AJava%E5%AE%89%E5%85%A8-%E5%8F%AA%E6%9C%89Java%E5%AE%89%E5%85%A8%E6%89%8D%E8%83%BD%E6%8B%AF%E6%95%91%E5%AE%87%E5%AE%99%E3%80%8B&font=Rokkitt&forks=1&issues=1&name=1&owner=0&pattern=Floating%20Cogs&pulls=1&stargazers=1&theme=Light)
44

5-
本项目是记录自己在学习研究Java安全过程中遇到的优秀内容，包括Java代码审计资源以及Java开发的应用程序组件协议等的安全内容。一个不会Java攻击的黑客不是一个好师傅，一个不懂Java安全的师傅不是一个好黑客！深入理解Java安全，手握众多重点Java应用高危0day！作者：[0e0w](https://github.com/0e0w)
5+
本项目是记录自己在学习研究Java安全过程中遇到的优秀资源，包括Java安全的多个细分领域，如Java漏洞分析和Java代码审计以及Java开发的应用程序组件协议甚至Java本身的安全问题等。一个不能攻击Java的黑客不是一个好黑客，一个不懂Java安全的师傅不是一个好师傅！深入理解Java安全，拯救宇宙！作者：[0e0w](https://github.com/0e0w)
66

7-
本项目创建于2021年7月8日，最近的一次更新时间为2023年3月17日。本项目会持续更新，直到海枯石烂。
7+
本项目创建于2021年7月8日，最近的一次更新时间为2023年6月29日。本项目会持续更新，直到海枯石烂。
88

99
- [01-Java安全研究资源](https://github.com/HackJava/HackJava#01-java%E5%AE%89%E5%85%A8%E7%A0%94%E7%A9%B6%E8%B5%84%E6%BA%90)
10-
- [02-Java安全研究工具](https://github.com/HackJava/HackJava#02-java%E5%AE%89%E5%85%A8%E7%A0%94%E7%A9%B6%E5%B7%A5%E5%85%B7)
11-
- [03-Java安全漏洞环境](https://github.com/HackJava/HackJava#03-java%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83)
12-
- [04-Java安全漏洞分类](https://github.com/HackJava/HackJava#04-Java%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E5%88%86%E7%B1%BB)
13-
- [05-Java安全代码审计](https://github.com/HackJava/HackJava#05-Java%E5%AE%89%E5%85%A8%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1)
14-
- [06-Java安全漏洞修复](https://github.com/HackJava/HackJava#06-java%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E4%BF%AE%E5%A4%8D)
15-
- [07-Java安全高危应用](https://github.com/HackJava/HackJava#07-java%E5%AE%89%E5%85%A8%E9%AB%98%E5%8D%B1%E5%BA%94%E7%94%A8)
16-
- [08-Java安全参考资源](https://github.com/HackJava/HackJava#08-java%E5%AE%89%E5%85%A8%E5%8F%82%E8%80%83%E8%B5%84%E6%BA%90)
10+
- [02-Java安全研究方向](https://github.com/HackJava/HackJava#02-java%E5%AE%89%E5%85%A8%E7%A0%94%E7%A9%B6%E6%96%B9%E5%90%91)
11+
- [03-Java安全研究工具](https://github.com/HackJava/HackJava#03-java%E5%AE%89%E5%85%A8%E7%A0%94%E7%A9%B6%E5%B7%A5%E5%85%B7)
12+
- [04-Java安全漏洞环境](https://github.com/HackJava/HackJava#04-java%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83)
13+
- [05-Java安全漏洞修复](https://github.com/HackJava/HackJava#05-java%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E4%BF%AE%E5%A4%8D)
14+
- [06-Java安全高危应用](https://github.com/HackJava/HackJava#06-java%E5%AE%89%E5%85%A8%E9%AB%98%E5%8D%B1%E5%BA%94%E7%94%A8)
15+
- [07-Java安全参考资源](https://github.com/HackJava/HackJava#07-java%E5%AE%89%E5%85%A8%E5%8F%82%E8%80%83%E8%B5%84%E6%BA%90)
1716

1817
## 01-Java安全研究资源
1918

20-
一、书籍资料
19+
**一、书籍资料**
2120
- [ ] [《Java代码审计-入门篇》](https://item.jd.com/10033832360716.html)@陈俊杰等
2221
- [ ] [《Java代码审计实战》](https://item.jd.com/13466996.html)@高昌盛等
2322
- [ ] [《Java安全编码标准》](https://book.douban.com/subject/24846041)@计文柯译
@@ -26,7 +25,8 @@
2625
- [ ] [《Java编码指南》](https://www.amazon.co.uk/%E7%BC%96%E5%86%99%E5%AE%89%E5%85%A8%E5%8F%AF%E9%9D%A0%E7%A8%8B%E5%BA%8F%E7%9A%8475%E6%9D%A1%E5%BB%BA%E8%AE%AE%EF%BC%88%E8%8B%B1%E6%96%87%E7%89%88%EF%BC%89-%E5%BE%B7%E9%B2%81%C2%B7%E8%8E%AB%E6%AC%A3%E8%BE%BE%EF%BC%88Dhruv-C-%E8%A5%BF%E7%A7%91%E5%BE%B7%EF%BC%88Robert-F-%E8%90%A8%E7%91%9F%E5%85%B0%EF%BC%88Dean-%E5%BC%97%E9%9B%B7%E5%BE%B7%C2%B7%E6%9C%97%EF%BC%88Fred/dp/B017WGUFKO)@刘先宁
2726
- [ ] [《Java-Web-Security》](https://play.google.com/store/books/details/Java_Web_Security_Sichere_Webanwendungen_mit_Java_?id=ZxZ4DwAAQBAJ&hl=en_US&gl=US)@Dominik Schadow
2827

29-
二、基础教程
28+
**二、基础教程**
29+
3030
- [ ] [《Java Web安全-代码审计》](https://github.com/javaweb-sec/javaweb-sec)@凌天实验室
3131
- [ ] [《Java安全漫谈笔记相关内容》](https://github.com/phith0n/JavaThings)@phith0n
3232
- [ ] [《Java代码审计学习笔记》](https://github.com/proudwind/javasec_study)@proudwind
@@ -44,21 +44,22 @@
4444
- [ ] [《跟我一起JAVA代码审计》](https://www.freebuf.com/column/1289)@0neOfU4
4545
- [ ] [《告别脚本小子系列丨JAVA安全》](https://mp.weixin.qq.com/s/oEI1GLJKSoSLxMcAhFFWKQ)@烽火台实验室
4646

47-
三、视频教程
47+
**三、视频教程**
48+
4849
- [ ] [《MS08067安全实验室》](https://space.bilibili.com/396298765?spm_id_from=333.788.b_765f7570696e666f.2)@MS08067
4950
- [ ] [《Java代码审计系列课程》](https://edu.51cto.com/course/27875.html)@Hack_Man
5051
- [ ] [《Java代码审计课程》](https://www.learnfuture.com/study/ist126v)@嘉为教育
5152
- [ ] [《宽字节安全 JAVA安全线上进阶课程》](https://www.cnblogs.com/unicodeSec/p/15062087.html)@宽字节
5253
- [ ] [《Securing Java Web Applications》](https://www.pluralsight.com/courses/java-web-application-security-vulnerabilities)@Josh Cummings
5354

54-
四、培训演讲
55+
**四、培训演讲**
56+
57+
**五、专利文献**
5558

56-
五、专利文献
5759
- [ ] [一种基于java的web动态安全漏洞检测方法](https://patents.google.com/patent/CN103699480B/zh)@安恒
5860

59-
六、审计报告
61+
**六、其他资源**
6062

61-
七、其他资源
6263
- [ ] https://github.com/topics/static-analysis?l=java
6364
- [ ] [《攻击Java Web应用》](https://zhishihezi.net/b/5d644b6f81cbc9e40460fe7eea3c7925)@javasec
6465
- [ ] [《J2EE 渗透测试与安全开发》](https://zhishihezi.net/b/98ae566719b21536dff0c4febaa697d2)@路人甲
@@ -100,12 +101,37 @@
100101
- [ ] [记录一下 Java 安全学习历程](https://github.com/Drun1baby/JavaSecurityLearning)
101102
- [ ] https://github.com/Er1cccc/ACAF
102103
- [ ] https://github.com/cri1wa/MemShell
104+
- [ ] https://github.com/Y4tacker/JavaSec
105+
106+
## 02-Java安全研究方向
107+
108+
**一、Web漏洞**
109+
- [ ] 任意命令执行漏洞
110+
- [ ] 任意文件上传漏洞
111+
- [ ] 任意文件写入漏洞
112+
- [ ] 任意文件包含漏洞
113+
- [ ] 任意文件删除漏洞
114+
- [ ] Java反序列化漏洞
115+
- [ ] SQL注入漏洞
116+
- [ ] 业务逻辑漏洞
117+
- [ ] 变量覆盖漏洞
118+
- [ ] 程序安装问题
119+
- [ ] XSS漏洞
120+
- [ ] XXE漏洞
121+
- [ ] SSRF漏洞
122+
- [ ] CSRF漏洞
123+
124+
**二、Java代码审计**
125+
- [ ] https://github.com/ax1sX/SecurityList
103126

104-
## 02-Java安全研究工具
127+
**三、Java内存马**
128+
- [ ] https://github.com/Getshell/Mshell
129+
130+
## 03-Java安全研究工具
105131

106132
工欲善其事必先利其器，此处收集整理Java代码审计的一些优秀工具！期待自己的代码审计工具能够早日发布！
107133

108-
一、SAST
134+
**一、SAST**
109135
- [ ] https://github.com/ASTTeam/SAST
110136
- [ ] https://github.com/wooyunwang/Fortify
111137
- [ ] https://github.com/FeeiCN/Cobra
@@ -116,21 +142,21 @@
116142
- [ ] https://github.com/noidsirius/SootTutorial
117143
- [ ] [Tencent Xcheck](https://cloud.tencent.com/product/asd)
118144

119-
二、DAST
145+
**二、DAST**
120146
- [ ] https://github.com/ASTTeam/DAST
121147

122-
三、IAST
148+
**三、IAST**
123149
- [ ] https://github.com/ASTTeam/IAST
124150
- [ ] https://github.com/HXSecurity/DongTai
125151

126-
四、CodeQL
152+
**四、CodeQL**
127153
- [ ] https://github.com/ASTTeam/CodeQL
128-
- [ ] https://codeql.github.com
129154

130-
五、RASP
155+
**五、RASP**
131156
- [ ] https://github.com/0e0w/RASP
132157

133-
六、JNDI
158+
**六、JNDI**
159+
134160
- [ ] https://github.com/HackJava/JNDI
135161
- [ ] https://github.com/bradfitz/jndi
136162
- [ ] https://github.com/EmYiQing/LDAPKit
@@ -146,7 +172,7 @@
146172
- [ ] https://github.com/zu1k/ldap-log
147173
- [ ] https://github.com/orleven/Celestion
148174

149-
七、Deserialization
175+
**七、ysoserial**
150176
- [ ] https://github.com/wh1t3p1g/ysomap
151177
- [ ] https://github.com/frohoff/ysoserial
152178
- [ ] https://github.com/KpLi0rn/ysoserial
@@ -160,17 +186,17 @@
160186
- [ ] https://github.com/j1anFen/ysoserial_echo
161187
- [ ] https://github.com/EmYiQing/ShortPayload
162188

163-
八、Monitor
189+
**八、Monitor**
164190
- [ ] https://github.com/TheKingOfDuck/FileMonitor
165191
- [ ] https://github.com/TheKingOfDuck/MySQLMonitor
166192
- [ ] https://github.com/Lotus6/FileMonitor
167193

168-
九、IDEA
194+
**九、IDEA**
169195
- [ ] https://github.com/XianYanTechnology/RocB
170196
- [ ] https://github.com/momosecurity/momo-code-sec-inspector-java
171197
- [ ] https://github.com/XmirrorSecurity/OpenSCA-intellij-plugin
172198

173-
十、Others
199+
**十、Others**
174200
- [ ] https://github.com/MobSF/mobsfscan
175201
- [ ] https://github.com/threedr3am/log-agent
176202
- [ ] https://github.com/wh1t3p1g/tabby
@@ -201,7 +227,7 @@
201227
- [ ] https://github.com/hluwa/Wallbreaker
202228
- [ ] https://github.com/4ra1n/code-inspector
203229

204-
## 03-Java安全漏洞环境
230+
## 04-Java安全漏洞环境
205231

206232
此处收集整理Java安全漏洞研究的一些环境，包括Web环境，应用框架漏洞环境等。
207233

@@ -237,72 +263,47 @@
237263
- [ ] https://github.com/pmiaowu/RMITest
238264
- [ ] https://github.com/OWASP-Benchmark/BenchmarkJava
239265
- [ ] https://github.com/EmYiQing/CIDemo
240-
- [ ] https://github.com/Y4tacker/JavaSec
241266
- [ ] https://github.com/javaweb-sec/javaweb-vuls
242267
- [ ] https://github.com/LandGrey/SpringBootVulExploit
243268
- [ ] https://github.com/linjiananallnt/ElectricRat
244269

245-
## 04-Java安全漏洞分类
246-
247-
- Java反序列化漏洞
248-
- 任意命令执行漏洞
249-
- 任意文件上传漏洞
250-
- 任意文件写入漏洞
251-
- 任意文件包含漏洞
252-
- 任意文件删除漏洞
253-
- SQL注入漏洞
254-
- 业务逻辑漏洞
255-
- 变量覆盖漏洞
256-
- 程序安装问题
257-
- XSS漏洞
258-
- XXE漏洞
259-
- SSRF漏洞
260-
- CSRF漏洞
261-
262-
## 05-Java安全代码审计
263-
264-
一、Java安全Web漏洞
265-
- [ ] https://github.com/ax1sX/SecurityList
266-
267-
二、Java代码审计实战
268-
269-
## 06-Java安全漏洞修复
270+
## 05-Java安全漏洞修复
270271

271272
一、Java安全编码规范
272273
- [x] [《Java安全编码标准》](https://developer.aliyun.com/article/175341)@计文柯
273-
- [OWASP 安全编码规范](https://owasp.org/www-pdf-archive/OWASP_SCP_Quick_Reference_Guide_%28Chinese%29.pdf)
274-
- [腾讯-Java安全编码规范](https://github.com/Tencent/secguide/blob/main/Java%E5%AE%89%E5%85%A8%E6%8C%87%E5%8D%97.md)
275-
- [陌陌-Java安全编码规范](https://github.com/momosecurity/rhizobia_J)
276-
- 华为-Java安全编码规范
277-
- 绿盟-Java安全编码规范
278-
- 奇安信-Java安全编码规范
279-
- 软通动力-Java-Web安全开发规范
280-
- [securitypaper-Java安全编码规范](https://www.securitypaper.org/2.sdl%E8%A7%84%E8%8C%83%E6%96%87%E6%A1%A3/3-java%E5%AE%89%E5%85%A8%E7%BC%96%E7%A0%81%E8%A7%84%E8%8C%83)
274+
- [ ] [OWASP 安全编码规范](https://owasp.org/www-pdf-archive/OWASP_SCP_Quick_Reference_Guide_%28Chinese%29.pdf)
275+
- [ ] [腾讯-Java安全编码规范](https://github.com/Tencent/secguide/blob/main/Java%E5%AE%89%E5%85%A8%E6%8C%87%E5%8D%97.md)
276+
- [ ] [陌陌-Java安全编码规范](https://github.com/momosecurity/rhizobia_J)
277+
- [ ] 华为-Java安全编码规范
278+
- [ ] 绿盟-Java安全编码规范
279+
- [ ] 奇安信-Java安全编码规范
280+
- [ ] 软通动力-Java-Web安全开发规范
281+
- [ ] [securitypaper-Java安全编码规范](https://www.securitypaper.org/2.sdl%E8%A7%84%E8%8C%83%E6%96%87%E6%A1%A3/3-java%E5%AE%89%E5%85%A8%E7%BC%96%E7%A0%81%E8%A7%84%E8%8C%83)
281282

282283
二、Java安全漏洞修复
283284

284-
## 07-Java高危应用框架
285+
## 06-Java高危应用框架
285286

286287
此处整理收集Java开发的普遍使用的程序：包括中间件、核心框架、底层库、重要应用系统等。待更新。
287288

288-
- [Log4j2](https://github.com/HackJava/Log4j2)
289-
- [Shiro](https://github.com/HackJava/Shiro)
290-
- [Weblogic](https://github.com/HackJava/Weblogic)
291-
- MyBatis
292-
- Spring
289+
- [ ] [Log4j2](https://github.com/HackJava/Log4j2)
290+
- [ ] [Shiro](https://github.com/HackJava/Shiro)
291+
- [ ] [Weblogic](https://github.com/HackJava/Weblogic)
292+
- [ ] MyBatis
293+
- [ ] Spring
293294

294-
## 08-Java安全参考资源
295+
## 07-Java安全参考资源
295296

296297
本人在学习Java安全的过程中遇到了很多优秀的Java安全研究员，感谢这些研究者！排名不分先后。
297298

298-
- https://github.com/4ra1n
299-
- https://github.com/phith0n
300-
- https://github.com/su18
301-
- https://github.com/welk1n
302-
- https://github.com/threedr3am
303-
- https://github.com/Y4er
304-
- https://github.com/wh1t3p1g
305-
- https://xz.aliyun.com/u/44415
299+
- [ ] https://github.com/4ra1n
300+
- [ ] https://github.com/phith0n
301+
- [ ] https://github.com/su18
302+
- [ ] https://github.com/welk1n
303+
- [ ] https://github.com/threedr3am
304+
- [ ] https://github.com/Y4er
305+
- [ ] https://github.com/wh1t3p1g
306+
- [ ] https://xz.aliyun.com/u/44415
306307

307308
## Stargazers
308309

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy