Skip to content

Commit cd2e13f

Browse files
0e0w0e0w
committed
Update README.md
1 parent 1cfd3e7 commit cd2e13f

File tree

1 file changed

+77
-61
lines changed

1 file changed

+77
-61
lines changed

‎README.md

Lines changed: 77 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -2,32 +2,84 @@
22

33
本项目是记录自己在学习Java代码审计过程中遇到的优秀内容，包括Java代码审计技巧以及优秀的Java代码审计案例。一个不会Java代码审计的师傅不是一个好黑客，一个不会Java代码审计的黑客不是一个好师傅！深入理解Java代码审计，手握众多重点Java应用高危0day！作者：[0e0w](https://github.com/0e0w/HackJava)
44

5-
本项目创建于2021年7月8日，最近的一次更新时间为2021年11月10日。本项目会持续更新，直到海枯石烂。
5+
本项目创建于2021年7月8日，最近的一次更新时间为2021年11月12日。本项目会持续更新，直到海枯石烂。
66

7-
- [0x01-Java代码审计资源](https://github.com/0e0w/HackJava#0x01-Java%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E8%B5%84%E6%BA%90)
8-
- [0x02-Java漏洞靶场平台](https://github.com/0e0w/HackJava#0x02-Java%E6%BC%8F%E6%B4%9E%E9%9D%B6%E5%9C%BA%E5%B9%B3%E5%8F%B0)
9-
- [0x03-Java代码审计工具](https://github.com/0e0w/HackJava#0x03-Java%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E5%B7%A5%E5%85%B7)
10-
- [0x04-Java代码审计案例](https://github.com/0e0w/HackJava#0x04-Java%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E6%A1%88%E4%BE%8B)
11-
- [0x05-Java安全Web漏洞](https://github.com/0e0w/Hackjava#0x04-Java%E5%B8%B8%E8%A7%84Web%E6%BC%8F%E6%B4%9E)
12-
- [0x06-Java安全编码规范](https://github.com/0e0w/Hackjava#0x06-Java%E5%AE%89%E5%85%A8%E7%BC%96%E7%A0%81%E8%A7%84%E8%8C%83)
13-
- [0x07-Java代码审计培训](https://github.com/0e0w/Hackjava#0x07-Java%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E5%9F%B9%E8%AE%AD)
14-
- [0x08-Java代码审计老师](https://github.com/0e0w/Hackjava#0x08-Java%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E8%80%81%E5%B8%88)
7+
- [01-Java代码审计资源]()
8+
- [02-Java代码审计工具]()
9+
- [03-Java漏洞靶场平台]()
10+
- [04-Java安全Web漏洞]()
11+
- [05-Java代码审计实战]()
12+
- [06-Java安全编码规范]()
13+
- [08-Java代码审计老师]()
1514

16-
## 0x01-Java代码审计资源
15+
## 01-Java代码审计资源
1716

18-
一、书籍资源
17+
一、书籍教程
1918
- [ ] [《Java代码审计 入门篇》](https://item.jd.com/10033832360716.html)@陈俊杰等
2019
- [ ] [《Java代码审计实战》](https://item.jd.com/13466996.html)@高昌盛等
2120

22-
二、视频教程
23-
- [ ] [《MS08067安全实验室》](https://space.bilibili.com/396298765?spm_id_from=333.788.b_765f7570696e666f.2)
21+
- [ ] [《Java Web安全-代码审计》]()@凌天实验室
22+
- [ ] [《Java安全漫谈笔记相关》](https://github.com/phith0n/JavaThings)@phith0n
23+
24+
二、审计案例
2425

25-
三、其他资源
26+
- [ ] https://github.com/proudwind/javasec_study
27+
- [ ] https://github.com/threedr3am/learnjavabug
28+
- [ ] https://github.com/SummerSec/JavaLearnVulnerability
29+
- [ ] https://github.com/cn-panda/JavaCodeAudit
30+
- [ ] https://github.com/Maskhe/javasec
31+
- [ ] https://github.com/anbai-inc/javaweb-sec
32+
- [ ] https://github.com/feihong-cs/Java-Rce-Echo
33+
- [ ] https://github.com/Y4er/WebLogic-Shiro-shell
34+
- [ ] https://github.com/feihong-cs/Java-Rce-Echo
35+
- [ ] https://github.com/feihong-cs/JNDIExploit
36+
- [ ] https://github.com/welk1n/JNDI-Injection-Exploit
37+
- [ ] https://github.com/March110/javaweb-sec
38+
- [ ] https://github.com/wh1t3p1g/ysomap
39+
- [ ] https://github.com/returntocorp/semgrep
40+
- [ ] https://github.com/MobSF/mobsfscan
41+
- [ ] https://github.com/huyuanzhi2/CodeReview
42+
- [ ] https://github.com/su18/JDBC-Attack
43+
- [ ] https://github.com/7hang/--Java
44+
- [ ] https://github.com/5huai/POC-Test
45+
- [ ] https://github.com/iiiusky/javaweb-codereview
2646
- [ ] https://github.com/Firebasky/Java
47+
48+
三、视频教程
49+
50+
- [ ] [《MS08067安全实验室》](https://space.bilibili.com/396298765?spm_id_from=333.788.b_765f7570696e666f.2)
51+
52+
四、培训演讲
53+
54+
五、审计报告
55+
56+
五、其他资源
57+
2758
- [ ] [《攻击Java Web应用》](https://appts4jvi.zhishibox.net/b/5d644b6f81cbc9e40460fe7eea3c7925)
2859
- [ ] [《静态程序分析入门教程》](https://github.com/RangerNJU/Static-Program-Analysis-Book)
2960

30-
## 0x02-Java漏洞靶场平台
61+
## 02-Java代码审计工具
62+
63+
工欲善其事必先利其器，此处收集整理Java代码审计的一些优秀工具！期待自己的代码审计工具能够早日发布！
64+
65+
一、Frotify
66+
- [ ] https://github.com/wooyunwang/Fortify
67+
- [ ] https://github.com/5wimming/gadgetinspector
68+
69+
二、IDEA
70+
- [ ] https://github.com/XianYanTechnology/RocB
71+
72+
三、其他
73+
- [ ] https://github.com/MobSF/mobsfscan
74+
- [ ] https://github.com/threedr3am/log-agent
75+
- [ ] https://github.com/wh1t3p1g/tabby
76+
- [ ] https://github.com/KpLi0rn/ysoserial
77+
- [ ] https://github.com/EmYiQing/XVulnFinder
78+
- [ ] https://github.com/EmYiQing/CodeInspector
79+
- [ ] https://github.com/mtxiaowangzi/CAFJE
80+
- [ ] https://github.com/FeeiCN/Cobra
81+
82+
## 03-Java漏洞靶场平台
3183

3284
- [ ] https://github.com/Mysticbinary/WebBug
3385
- [ ] https://github.com/dschadow/JavaSecurity
@@ -48,48 +100,10 @@
48100
- [ ] https://github.com/CSPF-Founder/JavaVulnerableLab
49101
- [ ] https://github.com/t0thkr1s/allsafe
50102
- [ ] https://github.com/bit4woo/Java_deserialize_vuln_lab
51-
52-
## 0x03-Java代码审计工具
53-
54-
一、Frotify
55-
- [ ] https://github.com/wooyunwang/Fortify
56-
- [ ] https://github.com/5wimming/gadgetinspector
57-
58-
二、IDEA
59-
- [ ] https://github.com/XianYanTechnology/RocB
60-
61-
三、其他
62-
- [ ] https://github.com/MobSF/mobsfscan
63-
- [ ] https://github.com/threedr3am/log-agent
64-
- [ ] https://github.com/wh1t3p1g/tabby
65-
- [ ] https://github.com/KpLi0rn/ysoserial
66-
- [ ] https://github.com/EmYiQing/XVulnFinder
67-
- [ ] https://github.com/EmYiQing/CodeInspector
68-
69-
## 0x04-Java代码审计案例
70-
103+
- [ ] https://github.com/mtxiaowangzi/Java-EE-VulnWeb
71104
- [ ] https://github.com/j3ers3/Hello-Java-Sec
72-
- [ ] https://github.com/proudwind/javasec_study
73-
- [ ] https://github.com/threedr3am/learnjavabug
74-
- [ ] https://github.com/SummerSec/JavaLearnVulnerability
75-
- [ ] https://github.com/cn-panda/JavaCodeAudit
76-
- [ ] https://github.com/Maskhe/javasec
77-
- [ ] https://github.com/phith0n/JavaThings
78-
- [ ] https://github.com/anbai-inc/javaweb-sec
79-
- [ ] https://github.com/feihong-cs/Java-Rce-Echo
80-
- [ ] https://github.com/Y4er/WebLogic-Shiro-shell
81-
- [ ] https://github.com/feihong-cs/Java-Rce-Echo
82-
- [ ] https://github.com/feihong-cs/JNDIExploit
83-
- [ ] https://github.com/welk1n/JNDI-Injection-Exploit
84-
- [ ] https://github.com/March110/javaweb-sec
85-
- [ ] https://github.com/wh1t3p1g/ysomap
86-
- [ ] https://github.com/returntocorp/semgrep
87-
- [ ] https://github.com/mtxiaowangzi/CAFJE
88-
- [ ] https://github.com/MobSF/mobsfscan
89-
- [ ] https://github.com/huyuanzhi2/CodeReview
90-
- [ ] https://github.com/su18/JDBC-Attack
91105

92-
## 0x05-Java安全Web漏洞
106+
## 04-Java安全Web漏洞
93107

94108
本部分详细列举常见的Java安全漏洞内容。
95109

@@ -114,15 +128,17 @@
114128
- CSRF跨站请求伪造
115129
- SSRF服务端请求伪造
116130

117-
## 0x06-Java安全编码规范
131+
## 05-Java代码审计实战
118132

119-
- [ ] 腾讯集团-Java安全编码规范
120-
- [ ] 奇安信集团-Java安全编码规范
121-
- [ ] [陌陌集团-Java安全编码规范](https://github.com/momosecurity/rhizobia_J)
133+
## 06-Java安全编码规范
122134

123-
## 0x07-Java代码审计培训
135+
- 腾讯-Java安全编码规范
136+
- 奇安信-Java安全编码规范
137+
- [陌陌-Java安全编码规范](https://github.com/momosecurity/rhizobia_J)
138+
- 华为-Java安全编码规范
139+
- 软通动力-Java-Web安全开发规范
124140

125-
## 0x08-Java代码审计老师
141+
## 07-Java代码审计老师
126142

127143
本人在学习Java代码审计的过程中遇到了很多优秀的Java代码审计工程师，感谢这些研究者！
128144

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy