Skip to content

Commit 516598a

Browse files
0e0w0e0w
committed
Update README.md
1 parent ac496c1 commit 516598a

1 file changed

Lines changed: 37 additions & 33 deletions

File tree

‎README.md‎

Lines changed: 37 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
本项目是记录自己在学习Java代码审计过程中遇到的优秀内容，包括Java代码审计技巧以及优秀的Java代码审计案例。一个不会Java代码审计的师傅不是一个好黑客，一个不会Java代码审计的黑客不是一个好师傅！深入理解Java代码审计，手握众多重点Java应用高危0day！作者：[0e0w](https://github.com/0e0w/HackJava)
44

5-
本项目创建于2021年7月8日，最近的一次更新时间为2021年11月13日。本项目会持续更新，直到海枯石烂。
5+
本项目创建于2021年7月8日，最近的一次更新时间为2021年11月15日。本项目会持续更新，直到海枯石烂。
66

77
- [01-Java代码审计资源](https://github.com/0e0w/HackJava#01-java%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E8%B5%84%E6%BA%90)
88
- [02-Java代码审计工具](https://github.com/0e0w/HackJava#02-java%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E5%B7%A5%E5%85%B7)
@@ -14,13 +14,14 @@
1414

1515
## 01-Java代码审计资源
1616

17-
一、书籍教程
17+
一、书籍资料
1818
- [ ] [《Java代码审计 入门篇》](https://item.jd.com/10033832360716.html)@陈俊杰等
1919
- [ ] [《Java代码审计实战》](https://item.jd.com/13466996.html)@高昌盛等
20-
- [ ] [《Java Web安全-代码审计》]()@凌天实验室
21-
- [ ] [《Java安全漫谈笔记相关》](https://github.com/phith0n/JavaThings)@phith0n
20+
- [ ] [《Java-Web-Security》]()@Dominik Schadow
2221

23-
二、审计案例
22+
二、基础教程
23+
- [ ] [《Java Web安全-代码审计》]()@凌天实验室
24+
- [ ] [《Java安全漫谈笔记相关内容》](https://github.com/phith0n/JavaThings)@phith0n
2425
- [ ] [《Java代码审计学习笔记》](https://github.com/proudwind/javasec_study)@proudwind
2526
- [ ] [《Java漏洞学习笔记》](https://github.com/SummerSec/JavaLearnVulnerability)@SummerSec
2627
- [ ] [《代码审计入门小项目》](https://github.com/cn-panda/JavaCodeAudit)@cn-panda
@@ -33,9 +34,10 @@
3334
- [ ] [《Java代码审计案例》](https://github.com/5huai/POC-Test)@5huai
3435
- [ ] [《java安全和java框架漏洞》](https://github.com/Firebasky/Java)@Firebasky
3536
- [ ] [《Java安全相关的漏洞和技术demo》](https://github.com/threedr3am/learnjavabug)@threedr3am
37+
- [ ] [《跟我一起JAVA代码审计》](https://www.freebuf.com/column/1289)@0neOfU4
3638

3739
三、视频教程
38-
- [ ] [《MS08067安全实验室》](https://space.bilibili.com/396298765?spm_id_from=333.788.b_765f7570696e666f.2)
40+
- [ ] [《MS08067安全实验室》](https://space.bilibili.com/396298765?spm_id_from=333.788.b_765f7570696e666f.2)@MS08067
3941
- [ ] [《Java代码审计系列课程》](https://edu.51cto.com/course/27875.html)@Hack_Man
4042

4143
四、培训演讲
@@ -47,14 +49,14 @@
4749
- [ ] [《J2EE 渗透测试与安全开发》](https://zhishihezi.net/b/98ae566719b21536dff0c4febaa697d2)@路人甲
4850
- [ ] [《静态程序分析入门教程》](https://github.com/RangerNJU/Static-Program-Analysis-Book)
4951
- [ ] https://github.com/su18/JDBC-Attack
52+
- [ ] https://xz.aliyun.com/t/7945
5053

5154
## 02-Java代码审计工具
5255

5356
工欲善其事必先利其器，此处收集整理Java代码审计的一些优秀工具！期待自己的代码审计工具能够早日发布！
5457

5558
一、Frotify
5659
- [ ] https://github.com/wooyunwang/Fortify
57-
- [ ] https://github.com/5wimming/gadgetinspector
5860

5961
二、IDEA
6062
- [ ] https://github.com/XianYanTechnology/RocB
@@ -72,9 +74,14 @@
7274
- [ ] https://github.com/KpLi0rn/ysoserial
7375
- [ ] https://github.com/0range228/Gadgets
7476
- [ ] https://github.com/ikkisoft/SerialKiller
77+
- [ ] https://github.com/5wimming/gadgetinspector
78+
- [ ] https://github.com/threedr3am/gadgetinspector
7579
- [ ] https://github.com/JackOfMostTrades/gadgetinspector
7680

77-
五、其他工具
81+
五、文件监控类工具
82+
- [ ] https://github.com/TheKingOfDuck/MySQLMonitor
83+
84+
六、其他工具
7885
- [ ] https://github.com/HXSecurity/DongTai
7986
- [ ] https://github.com/MobSF/mobsfscan
8087
- [ ] https://github.com/threedr3am/log-agent
@@ -87,29 +94,26 @@
8794

8895
## 03-Java漏洞靶场平台
8996

90-
- [ ] https://github.com/Mysticbinary/WebBug
91-
- [ ] https://github.com/dschadow/JavaSecurity
92-
- [ ] https://github.com/dschadow/Java-Web-Security
93-
- [ ] https://github.com/novysodope/mytestvul
94-
- [ ] https://github.com/langligelang/maobugs
95-
- [ ] https://github.com/ityouknow/spring-boot-examples
96-
- [ ] https://github.com/NanoHttpd/nanohttpd
97-
- [ ] https://github.com/TheKingOfDuck/MySQLMonitor
98-
- [ ] https://github.com/tangxiaofeng7/SecExample
99-
- [ ] https://github.com/JoyChou93/java-sec-code
100-
- [ ] https://github.com/Zhangyao-zzyy/JavaVulnerableLab-circle
97+
- [ ] [WebBug-JavaEE编写的Web漏洞靶场](https://github.com/Mysticbinary/WebBug)@mysticbinary
98+
- [ ] [JavaSecurity-Java Web漏洞演示程序](https://github.com/dschadow/JavaSecurity)@dschadow
99+
- [ ] [Java-Web-Security-书籍完整代码示例](https://github.com/dschadow/Java-Web-Security)@dschadow
100+
- [ ] [maobugs-Java 漏洞平台包含各种CVE演示](https://github.com/langligelang/maobugs)@langligelang
101+
- [ ] [SecExample-Java漏洞靶场](https://github.com/tangxiaofeng7/SecExample)@tangxiaofeng7
102+
- [ ] [java sec code-学习Java漏洞代码的项目](https://github.com/JoyChou93/java-sec-code)@JoyChou93
103+
- [ ] [dvja-该死的易受攻击的 Java EE应用程序](https://github.com/appsecco/dvja)@appsecco
104+
- [ ] [JavaVulnerableLab-易受攻击的Java Web应用程序](https://github.com/CSPF-Founder/JavaVulnerableLab)@CSPF-Founder
105+
- [ ] [Java_deserialize_vuln_lab-Java反序列化学习的实验代码](https://github.com/bit4woo/Java_deserialize_vuln_lab)@bit4woo
106+
- [ ] [Java-EE-VulnWeb用于演示的Java Web漏洞项目](https://github.com/mtxiaowangzi/Java-EE-VulnWeb)@mtxiaowangzi
107+
- [ ] [Hello Java Sec-Java安全编码和代码审计](https://github.com/j3ers3/Hello-Java-Sec)@3ers3
108+
- [ ] [javaweb codereview-演示java代码审计程序](https://github.com/iiiusky/javaweb-codereview)@iiiusky
109+
- [ ] [sqlilab Jsp-jsp版sqlilab 1-21关](https://github.com/yhy0/sqlilab-Jsp)@yhy0
110+
- [ ] [ShiroAndFastJson-shiro加fastjson环境](https://github.com/safe6Sec/ShiroAndFastJson)@safe6Sec
111+
- [ ] [mytestvul-一个用来做漏洞复现/验证的小框架](https://github.com/novysodope/mytestvul)@novysodope
112+
- [ ] [JavaVulnerableLab circle-练习Java反序列化的最简单环境](https://github.com/pmiaowu/DeserializationTest)@pmiaowu
113+
- [ ] [易受攻击的Java Web应用程序](https://github.com/Zhangyao-zzyy/JavaVulnerableLab-circle)@Zhangyao-zzyy
114+
- [ ] https://github.com/t0thkr1s/allsafe
101115
- [ ] https://github.com/oversecured/ovaa
102-
- [ ] https://github.com/appsecco/dvja
103116
- [ ] https://github.com/jaiswalakshansh/Vuldroid
104-
- [ ] https://github.com/safe6Sec/ShiroAndFastJson
105-
- [ ] https://github.com/CSPF-Founder/JavaVulnerableLab
106-
- [ ] https://github.com/t0thkr1s/allsafe
107-
- [ ] https://github.com/bit4woo/Java_deserialize_vuln_lab
108-
- [ ] https://github.com/mtxiaowangzi/Java-EE-VulnWeb
109-
- [ ] https://github.com/j3ers3/Hello-Java-Sec
110-
- [ ] https://github.com/iiiusky/javaweb-codereview
111-
- [ ] https://github.com/yhy0/sqlilab-Jsp
112-
- [ ] https://github.com/pmiaowu/DeserializationTest
113117

114118
## 04-Java安全Web漏洞
115119

@@ -125,10 +129,10 @@
125129
- 任意文件包含漏洞
126130
- 任意命令执行漏洞
127131
- Java反序列化漏洞
128-
- XSS跨站脚本攻击
129-
- XML外部实体攻击
130-
- CSRF跨站请求伪造
131-
- SSRF服务端请求伪造
132+
- XSS漏洞
133+
- XXE漏洞
134+
- CSRF漏洞
135+
- SSRF漏洞
132136

133137
## 05-Java代码审计实战
134138

0 commit comments

Comments
 (0)