Java代码审计手册,关注于漏洞挖掘而非利用【持续更新】
☆199Nov 21, 2024Updated last year
Alternatives and similar repositories for audit-java
Users that are interested in audit-java are comparing it to the libraries listed below
Sorting:
- IDEA代码审计辅助插件(深信服深蓝实验室天威战队强力驱动)☆581Mar 10, 2025Updated 11 months ago
- 亿赛通电子文档安全管理系统XStream反序列化漏洞任意文件上传利用☆120Aug 9, 2024Updated last year
- 一款支持自定义的 Java 回显载荷生成工具|A customizable Java echo payload generation tool.☆461Jan 12, 2025Updated last year
- 记录一些代码审计过的源码☆182Feb 26, 2025Updated last year
- 帆软bi反序列化漏洞利用工具☆190Mar 23, 2024Updated last year
- 🔍 CodeAuditAssistant - IDEA代码审计插件(公测中) ⚡ 精准追踪复杂调用链 | 🚀 毫秒级方法搜索 | 🔥 内置高危漏洞检测 原生集成 | 反编译/路径分析 | 内存优化 | 安全审计利器 🔍 Co…☆773Aug 3, 2025Updated 6 months ago
- 代码审计知识点整理-Java☆529Jun 15, 2020Updated 5 years ago
- Common Exploitation Techniques for Java RCE Vulnerabilities in Real-World Scenarios | 实战场景较通用的 Java Rce 相关漏洞的利用方式☆545Mar 6, 2025Updated 11 months ago
- FastJson全版本Docker漏洞环境(涵盖1.2.47/1.2.68/1.2.80等版本),主要包括JNDI注入及高版本绕过、waf绕过、文件读写、原生反序列化、利用链探测绕过、不出网利用等。从黑盒的角度覆盖FastJson深入利用☆1,182Jul 12, 2024Updated last year
- java代码审计学习笔记☆679Feb 24, 2020Updated 6 years ago
- 一款轻量级匹配Sink点的代码审计扫描器,为了帮助红队过程中快速代码审计的小工具☆409Oct 6, 2024Updated last year
- Java web路由内存分析工具☆437May 22, 2025Updated 9 months ago
- JavaGadgetGenerator 工具,支持 ysoserial,Hessian,字节码,Expr/SSTI,Shiro,JDBC 等 Gadget 生成,封装,混淆,出网延迟探测,内存马注入等...☆549Dec 7, 2025Updated 2 months ago
- javaeasyscanner - 富婆系列,代码审计辅助工具,致力于解放大脑,方便双手☆276Jun 18, 2024Updated last year
- 一款Java内存马生成、测试工具,搭配@ax1sX的MemShell食用。☆261Feb 15, 2026Updated last week
- Burp插件,自动化挖掘SSRF,Redirect,Sqli漏洞,自定义匹配参数☆451Sep 10, 2023Updated 2 years ago
- 互联网厂商API利用工具。☆555Sep 13, 2024Updated last year
- JAVA 安全靶场,IAST 测试用例,JAVA漏洞复现,代码审计,SAST测试用例,安全扫描(主动和被动),JAVA漏洞靶场,RASP测试用例 ; Java Security Testbed, IAST Test Cases, Java Vulnerability R…☆272Sep 6, 2024Updated last year
- 记录一下 Java 安全学习历程,也算是半条学习路线了☆1,315Jun 26, 2025Updated 8 months ago
- 对Auth/Waf 自动化bypass的burpsuite插件☆1,076Jan 26, 2026Updated last month
- "chanzi" is a simple and user-friendly JAVA SAST tool that utilizes taint analysis technology, includes built-in common vulnerability ru…☆479Feb 1, 2026Updated last month
- A powerful JNDI injection exploitation framework that supports RMI, LDAP and LDAPS protocols, including various bypass methods for high-v…☆569Feb 4, 2026Updated 3 weeks ago
- 80+ Gadgets(30 More than ysoserial). JNDI-Injection-Exploit-Plus is a tool for generating workable JNDI links and provide background serv…☆866Jun 24, 2024Updated last year
- 添加计划任务方法集合☆309Aug 6, 2023Updated 2 years ago
- JNDI在java高版本的利用工具,FUZZ利用链☆597Oct 8, 2022Updated 3 years ago
- 钓鱼上线后渗透工具☆132Feb 19, 2023Updated 3 years ago
- 梳理【护网高利用率POC】并集成Nuclei模板仓库,针对解决网上同一资产漏洞一键检测工具参次不齐问题。☆576Mar 21, 2024Updated last year
- 一款高性能 HTTP 内存代理 | 哥斯拉插件 | readteam | 红队 | 内存马 | Suo5 | Godzilla | 正向代理☆288Aug 8, 2023Updated 2 years ago
- java-web 自动化鉴权绕过☆375Apr 3, 2025Updated 10 months ago
- 【两万字原创】零基础学fastjson漏洞(提高篇),公众号:追梦信安☆211Dec 7, 2023Updated 2 years ago
- 本工具的定位是快速生成Java安全相关的Payload,如内存马、反序列化链、JNDI url、Fastjson等,动态生成相关Payload,并附带相应的文档。☆93Feb 25, 2025Updated last year
- Catcher(捕手) 重点系统指纹漏洞验证工具,适用于外网打点,资产梳理漏洞检查。☆317Feb 18, 2025Updated last year
- WEB安全手册(红队安全技能栈),漏洞理解,漏洞利用,代码审计和渗透测试总结。【持续更新】☆1,890Nov 7, 2025Updated 3 months ago
- 一款Jenkins的综合漏洞利用工具☆461Mar 20, 2024Updated last year
- a rep for documenting my study, may be from 0 to 0.1☆2,248Nov 10, 2025Updated 3 months ago
- Confluence CVE 2021,2022,2023 利用工具,支持命令执行,哥斯拉,冰蝎 内存马注入☆552Feb 1, 2024Updated 2 years ago
- 《深入JDBC安全:特殊URL构造与不出网反序列化利用技术揭秘》对应研究总结项目 "Deep Dive into JDBC Security: Special URL Construction and Non-Networked Deserialization Explo…☆570Feb 7, 2026Updated 3 weeks ago
- 集成了截图 键盘记录 剪贴版功能,用于网络限制场景下的信息搜集☆90May 18, 2024Updated last year
- 用友的一些反序列化链子以及1day,二开了狼组的YongYouNcTool,改了一下逻辑以及poc☆123Oct 12, 2024Updated last year