Skip to content

Commit 77a03a9

Browse files
0e0w0e0w
committed
Update README.md
1 parent 0a43879 commit 77a03a9

File tree

1 file changed

+67
-30
lines changed

1 file changed

+67
-30
lines changed

‎README.md‎

Lines changed: 67 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,9 @@
99
- [03-Java安全漏洞环境](https://github.com/0e0w/HackJava#03-java%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83)
1010
- [04-Java安全漏洞分类](https://github.com/0e0w/HackJava#04-Java%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E5%88%86%E7%B1%BB)
1111
- [05-Java安全代码审计](https://github.com/0e0w/HackJava#05-Java%E5%AE%89%E5%85%A8%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1)
12-
- [06-Java安全高危应用](https://github.com/0e0w/HackJava#06-java%E5%AE%89%E5%85%A8%E9%AB%98%E5%8D%B1%E5%BA%94%E7%94%A8)
13-
- [07-Java安全参考资源](https://github.com/0e0w/HackJava#07-java%E5%AE%89%E5%85%A8%E5%8F%82%E8%80%83%E8%B5%84%E6%BA%90)
12+
- [06-Java安全漏洞修复](https://github.com/0e0w/HackJava#06-java%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E4%BF%AE%E5%A4%8D)
13+
- [07-Java安全高危应用](https://github.com/0e0w/HackJava#07-java%E5%AE%89%E5%85%A8%E9%AB%98%E5%8D%B1%E5%BA%94%E7%94%A8)
14+
- [08-Java安全参考资源](https://github.com/0e0w/HackJava#08-java%E5%AE%89%E5%85%A8%E5%8F%82%E8%80%83%E8%B5%84%E6%BA%90)
1415

1516
## 01-Java安全研究资源
1617

@@ -87,20 +88,37 @@
8788

8889
工欲善其事必先利其器，此处收集整理Java代码审计的一些优秀工具！期待自己的代码审计工具能够早日发布！
8990

90-
一、IAST
91+
一、SAST
9192

92-
- 洞态 IAST
93+
- https://github.com/0e0w/SAST
9394

94-
二、CodeQL
95-
96-
- Frotify
9795
- [ ] https://github.com/wooyunwang/Fortify
98-
- RASP
99-
- IDEA
100-
- [ ] https://github.com/XianYanTechnology/RocB
101-
- [ ] https://github.com/momosecurity/momo-code-sec-inspector-java
102-
- [ ] https://github.com/XmirrorSecurity/OpenSCA-intellij-plugin
103-
- JNDI工具
96+
- [ ] https://github.com/FeeiCN/Cobra
97+
- [ ] https://github.com/LoRexxar/Kunlun-M
98+
- [ ] https://checkstyle.sourceforge.io
99+
100+
二、DAST
101+
102+
- https://github.com/0e0w/DAST
103+
104+
三、IAST
105+
106+
- https://github.com/0e0w/IAST
107+
- https://github.com/HXSecurity/DongTai
108+
109+
四、CodeQL
110+
111+
- https://github.com/0e0w/CodeQL
112+
- https://codeql.github.com
113+
114+
五、RASP
115+
116+
- https://github.com/0e0w/RASP
117+
118+
六、JNDI
119+
120+
- https://github.com/0e0w/JNDI
121+
104122
- [ ] https://github.com/bradfitz/jndi
105123
- [ ] https://github.com/EmYiQing/LDAPKit
106124
- [ ] https://github.com/su18/JNDI
@@ -114,7 +132,9 @@
114132
- [ ] https://github.com/exp1orer/JNDI-Inject-Exploit
115133
- [ ] https://github.com/zu1k/ldap-log
116134
- [ ] https://github.com/orleven/Celestion
117-
- 反序列化工具
135+
136+
七、Deserialization
137+
118138
- [ ] https://github.com/wh1t3p1g/ysomap
119139
- [ ] https://github.com/frohoff/ysoserial
120140
- [ ] https://github.com/KpLi0rn/ysoserial
@@ -125,27 +145,33 @@
125145
- [ ] https://github.com/JackOfMostTrades/gadgetinspector
126146
- [ ] https://github.com/Afant1/JavaSearchTools
127147
- [ ] https://github.com/j1anFen/ysoserial_echo
128-
- 文件监控类工具
148+
149+
八、Monitor
150+
129151
- [ ] https://github.com/TheKingOfDuck/FileMonitor
130152
- [ ] https://github.com/TheKingOfDuck/MySQLMonitor
131153
- [ ] https://github.com/Lotus6/FileMonitor
132-
- 其他工具
133-
- [ ] https://github.com/HXSecurity/DongTai
154+
155+
九、IDEA
156+
157+
- [ ] https://github.com/XianYanTechnology/RocB
158+
- [ ] https://github.com/momosecurity/momo-code-sec-inspector-java
159+
- [ ] https://github.com/XmirrorSecurity/OpenSCA-intellij-plugin
160+
161+
十、Others
162+
134163
- [ ] https://github.com/MobSF/mobsfscan
135164
- [ ] https://github.com/threedr3am/log-agent
136165
- [ ] https://github.com/wh1t3p1g/tabby
137166
- [ ] https://github.com/j5s/XVulnFinder
138167
- [ ] https://github.com/EmYiQing/CodeInspector
139168
- [ ] https://github.com/mtxiaowangzi/CAFJE
140-
- [ ] https://github.com/FeeiCN/Cobra
141169
- [ ] https://github.com/returntocorp/semgrep
142-
- [ ] https://codeql.github.com
143170
- [ ] https://github.com/cqkenuo/LingZhi
144171
- [ ] https://github.com/blinkfox/stalker
145172
- [ ] https://github.com/spotbugs/spotbugs
146173
- [ ] https://github.com/SonarSource/sonarqube
147174
- [ ] https://www.jarchitect.com
148-
- [ ] https://checkstyle.sourceforge.io
149175
- [ ] https://github.com/eclipse/eclemma
150176
- [ ] https://github.com/phith0n/zkar
151177
- [ ] https://github.com/Firebasky/GoRmi
@@ -189,27 +215,33 @@
189215
## 04-Java安全漏洞分类
190216

191217
- Java反序列化漏洞
218+
- 任意命令执行漏洞
192219
- 任意文件上传漏洞
193220
- 任意文件写入漏洞
194-
- 任意文件删除漏洞
195221
- 任意文件包含漏洞
196-
- 任意命令执行漏洞
197-
- 程序安装问题
198-
- 业务逻辑漏洞
222+
- 任意文件删除漏洞
199223
- SQL注入漏洞
224+
- 业务逻辑漏洞
200225
- 变量覆盖漏洞
226+
- 程序安装问题
201227
- XSS漏洞
202228
- XXE漏洞
203-
- CSRF漏洞
204229
- SSRF漏洞
230+
- CSRF漏洞
205231

206232
## 05-Java安全代码审计
207233

208234
一、Java安全Web漏洞
209235

210236
二、Java代码审计实战
211237

212-
三、Java安全编码规范
238+
## 06-Java安全漏洞修复
239+
240+
一、Java安全编码规范
241+
242+
- [x] [《Java安全编码标准》](https://developer.aliyun.com/article/175341)@计文柯
243+
244+
- [OWASP 安全编码规范](https://owasp.org/www-pdf-archive/OWASP_SCP_Quick_Reference_Guide_%28Chinese%29.pdf)
213245

214246
- [腾讯-Java安全编码规范](https://github.com/Tencent/secguide/blob/main/Java%E5%AE%89%E5%85%A8%E6%8C%87%E5%8D%97.md)
215247
- [陌陌-Java安全编码规范](https://github.com/momosecurity/rhizobia_J)
@@ -219,19 +251,24 @@
219251
- 软通动力-Java-Web安全开发规范
220252
- [securitypaper-Java安全编码规范](https://www.securitypaper.org/2.sdl%E8%A7%84%E8%8C%83%E6%96%87%E6%A1%A3/3-java%E5%AE%89%E5%85%A8%E7%BC%96%E7%A0%81%E8%A7%84%E8%8C%83)
221253

222-
## 06-Java安全高危应用
254+
二、Java安全漏洞修复
255+
256+
## 07-Java安全高危应用
257+
258+
此处整理收集Java开发的普遍使用的程序：包括中间件、核心框架、底层库、重要应用系统等。待更新。
223259

224-
## 07-Java安全参考资源
260+
## 08-Java安全参考资源
225261

226-
本人在学习Java代码审计的过程中遇到了很多优秀的Java代码审计工程师，感谢这些研究者！排名不分先后。
262+
本人在学习Java安全的过程中遇到了很多优秀的Java安全研究员，感谢这些研究者！排名不分先后。
227263

228264
- https://github.com/EmYiQing
229265
- https://github.com/phith0n
230266
- https://github.com/su18
231267
- https://github.com/welk1n
232268
- https://github.com/threedr3am
269+
- https://github.com/Y4er
233270

234-
## 08-Java安全交流群组
271+
## 09-Java安全交流群组
235272

236273
![](01-Java安全研究资源/TEMP/HackJava.png)
237274

0 commit comments

Comments
 (0)