|
2 | 2 |
|
3 | 3 |  |
4 | 4 |
|
5 | | -本项目是记录自己在学习研究Java安全过程中遇到的优秀内容，包括Java代码审计资源以及Java开发的应用程序组件协议等的安全内容。一个不会Java攻击的黑客不是一个好师傅，一个不懂Java安全的师傅不是一个好黑客！深入理解Java安全，手握众多重点Java应用高危0day！作者：[0e0w](https://github.com/0e0w) |
| 5 | +本项目是记录自己在学习研究Java安全过程中遇到的优秀资源，包括Java安全的多个细分领域，如Java漏洞分析和Java代码审计以及Java开发的应用程序组件协议甚至Java本身的安全问题等。一个不能攻击Java的黑客不是一个好黑客，一个不懂Java安全的师傅不是一个好师傅！深入理解Java安全，拯救宇宙！作者：[0e0w](https://github.com/0e0w) |
6 | 6 |
|
7 | | -本项目创建于2021年7月8日，最近的一次更新时间为2023年3月17日。本项目会持续更新，直到海枯石烂。 |
| 7 | +本项目创建于2021年7月8日，最近的一次更新时间为2023年6月29日。本项目会持续更新，直到海枯石烂。 |
8 | 8 |
|
9 | 9 | - [01-Java安全研究资源](https://github.com/HackJava/HackJava#01-java%E5%AE%89%E5%85%A8%E7%A0%94%E7%A9%B6%E8%B5%84%E6%BA%90) |
10 | | -- [02-Java安全研究工具](https://github.com/HackJava/HackJava#02-java%E5%AE%89%E5%85%A8%E7%A0%94%E7%A9%B6%E5%B7%A5%E5%85%B7) |
11 | | -- [03-Java安全漏洞环境](https://github.com/HackJava/HackJava#03-java%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83) |
12 | | -- [04-Java安全漏洞分类](https://github.com/HackJava/HackJava#04-Java%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E5%88%86%E7%B1%BB) |
13 | | -- [05-Java安全代码审计](https://github.com/HackJava/HackJava#05-Java%E5%AE%89%E5%85%A8%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1) |
14 | | -- [06-Java安全漏洞修复](https://github.com/HackJava/HackJava#06-java%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E4%BF%AE%E5%A4%8D) |
15 | | -- [07-Java安全高危应用](https://github.com/HackJava/HackJava#07-java%E5%AE%89%E5%85%A8%E9%AB%98%E5%8D%B1%E5%BA%94%E7%94%A8) |
16 | | -- [08-Java安全参考资源](https://github.com/HackJava/HackJava#08-java%E5%AE%89%E5%85%A8%E5%8F%82%E8%80%83%E8%B5%84%E6%BA%90) |
| 10 | +- [02-Java安全研究方向](https://github.com/HackJava/HackJava#02-java%E5%AE%89%E5%85%A8%E7%A0%94%E7%A9%B6%E6%96%B9%E5%90%91) |
| 11 | +- [03-Java安全研究工具](https://github.com/HackJava/HackJava#03-java%E5%AE%89%E5%85%A8%E7%A0%94%E7%A9%B6%E5%B7%A5%E5%85%B7) |
| 12 | +- [04-Java安全漏洞环境](https://github.com/HackJava/HackJava#04-java%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83) |
| 13 | +- [05-Java安全漏洞修复](https://github.com/HackJava/HackJava#05-java%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E4%BF%AE%E5%A4%8D) |
| 14 | +- [06-Java安全高危应用](https://github.com/HackJava/HackJava#06-java%E5%AE%89%E5%85%A8%E9%AB%98%E5%8D%B1%E5%BA%94%E7%94%A8) |
| 15 | +- [07-Java安全参考资源](https://github.com/HackJava/HackJava#07-java%E5%AE%89%E5%85%A8%E5%8F%82%E8%80%83%E8%B5%84%E6%BA%90) |
17 | 16 |
|
18 | 17 | ## 01-Java安全研究资源 |
19 | 18 |
|
20 | | -一、书籍资料 |
| 19 | +**一、书籍资料** |
21 | 20 | - [ ] [《Java代码审计-入门篇》](https://item.jd.com/10033832360716.html)@陈俊杰等 |
22 | 21 | - [ ] [《Java代码审计实战》](https://item.jd.com/13466996.html)@高昌盛等 |
23 | 22 | - [ ] [《Java安全编码标准》](https://book.douban.com/subject/24846041)@计文柯译 |
|
26 | 25 | - [ ] [《Java编码指南》](https://www.amazon.co.uk/%E7%BC%96%E5%86%99%E5%AE%89%E5%85%A8%E5%8F%AF%E9%9D%A0%E7%A8%8B%E5%BA%8F%E7%9A%8475%E6%9D%A1%E5%BB%BA%E8%AE%AE%EF%BC%88%E8%8B%B1%E6%96%87%E7%89%88%EF%BC%89-%E5%BE%B7%E9%B2%81%C2%B7%E8%8E%AB%E6%AC%A3%E8%BE%BE%EF%BC%88Dhruv-C-%E8%A5%BF%E7%A7%91%E5%BE%B7%EF%BC%88Robert-F-%E8%90%A8%E7%91%9F%E5%85%B0%EF%BC%88Dean-%E5%BC%97%E9%9B%B7%E5%BE%B7%C2%B7%E6%9C%97%EF%BC%88Fred/dp/B017WGUFKO)@刘先宁 |
27 | 26 | - [ ] [《Java-Web-Security》](https://play.google.com/store/books/details/Java_Web_Security_Sichere_Webanwendungen_mit_Java_?id=ZxZ4DwAAQBAJ&hl=en_US&gl=US)@Dominik Schadow |
28 | 27 |
|
29 | | -二、基础教程 |
| 28 | +**二、基础教程** |
| 29 | + |
30 | 30 | - [ ] [《Java Web安全-代码审计》](https://github.com/javaweb-sec/javaweb-sec)@凌天实验室 |
31 | 31 | - [ ] [《Java安全漫谈笔记相关内容》](https://github.com/phith0n/JavaThings)@phith0n |
32 | 32 | - [ ] [《Java代码审计学习笔记》](https://github.com/proudwind/javasec_study)@proudwind |
|
44 | 44 | - [ ] [《跟我一起JAVA代码审计》](https://www.freebuf.com/column/1289)@0neOfU4 |
45 | 45 | - [ ] [《告别脚本小子系列丨JAVA安全》](https://mp.weixin.qq.com/s/oEI1GLJKSoSLxMcAhFFWKQ)@烽火台实验室 |
46 | 46 |
|
47 | | -三、视频教程 |
| 47 | +**三、视频教程** |
| 48 | + |
48 | 49 | - [ ] [《MS08067安全实验室》](https://space.bilibili.com/396298765?spm_id_from=333.788.b_765f7570696e666f.2)@MS08067 |
49 | 50 | - [ ] [《Java代码审计系列课程》](https://edu.51cto.com/course/27875.html)@Hack_Man |
50 | 51 | - [ ] [《Java代码审计课程》](https://www.learnfuture.com/study/ist126v)@嘉为教育 |
51 | 52 | - [ ] [《宽字节安全 JAVA安全线上进阶课程》](https://www.cnblogs.com/unicodeSec/p/15062087.html)@宽字节 |
52 | 53 | - [ ] [《Securing Java Web Applications》](https://www.pluralsight.com/courses/java-web-application-security-vulnerabilities)@Josh Cummings |
53 | 54 |
|
54 | | -四、培训演讲 |
| 55 | +**四、培训演讲** |
| 56 | + |
| 57 | +**五、专利文献** |
55 | 58 |
|
56 | | -五、专利文献 |
57 | 59 | - [ ] [一种基于java的web动态安全漏洞检测方法](https://patents.google.com/patent/CN103699480B/zh)@安恒 |
58 | 60 |
|
59 | | -六、审计报告 |
| 61 | +**六、其他资源** |
60 | 62 |
|
61 | | -七、其他资源 |
62 | 63 | - [ ] https://github.com/topics/static-analysis?l=java |
63 | 64 | - [ ] [《攻击Java Web应用》](https://zhishihezi.net/b/5d644b6f81cbc9e40460fe7eea3c7925)@javasec |
64 | 65 | - [ ] [《J2EE 渗透测试与安全开发》](https://zhishihezi.net/b/98ae566719b21536dff0c4febaa697d2)@路人甲 |
|
100 | 101 | - [ ] [记录一下 Java 安全学习历程](https://github.com/Drun1baby/JavaSecurityLearning) |
101 | 102 | - [ ] https://github.com/Er1cccc/ACAF |
102 | 103 | - [ ] https://github.com/cri1wa/MemShell |
| 104 | +- [ ] https://github.com/Y4tacker/JavaSec |
| 105 | + |
| 106 | +## 02-Java安全研究方向 |
| 107 | + |
| 108 | +**一、Web漏洞** |
| 109 | +- [ ] 任意命令执行漏洞 |
| 110 | +- [ ] 任意文件上传漏洞 |
| 111 | +- [ ] 任意文件写入漏洞 |
| 112 | +- [ ] 任意文件包含漏洞 |
| 113 | +- [ ] 任意文件删除漏洞 |
| 114 | +- [ ] Java反序列化漏洞 |
| 115 | +- [ ] SQL注入漏洞 |
| 116 | +- [ ] 业务逻辑漏洞 |
| 117 | +- [ ] 变量覆盖漏洞 |
| 118 | +- [ ] 程序安装问题 |
| 119 | +- [ ] XSS漏洞 |
| 120 | +- [ ] XXE漏洞 |
| 121 | +- [ ] SSRF漏洞 |
| 122 | +- [ ] CSRF漏洞 |
| 123 | + |
| 124 | +**二、Java代码审计** |
| 125 | +- [ ] https://github.com/ax1sX/SecurityList |
103 | 126 |
|
104 | | -## 02-Java安全研究工具 |
| 127 | +**三、Java内存马** |
| 128 | +- [ ] https://github.com/Getshell/Mshell |
| 129 | + |
| 130 | +## 03-Java安全研究工具 |
105 | 131 |
|
106 | 132 | 工欲善其事必先利其器，此处收集整理Java代码审计的一些优秀工具！期待自己的代码审计工具能够早日发布！ |
107 | 133 |
|
108 | | -一、SAST |
| 134 | +**一、SAST** |
109 | 135 | - [ ] https://github.com/ASTTeam/SAST |
110 | 136 | - [ ] https://github.com/wooyunwang/Fortify |
111 | 137 | - [ ] https://github.com/FeeiCN/Cobra |
|
116 | 142 | - [ ] https://github.com/noidsirius/SootTutorial |
117 | 143 | - [ ] [Tencent Xcheck](https://cloud.tencent.com/product/asd) |
118 | 144 |
|
119 | | -二、DAST |
| 145 | +**二、DAST** |
120 | 146 | - [ ] https://github.com/ASTTeam/DAST |
121 | 147 |
|
122 | | -三、IAST |
| 148 | +**三、IAST** |
123 | 149 | - [ ] https://github.com/ASTTeam/IAST |
124 | 150 | - [ ] https://github.com/HXSecurity/DongTai |
125 | 151 |
|
126 | | -四、CodeQL |
| 152 | +**四、CodeQL** |
127 | 153 | - [ ] https://github.com/ASTTeam/CodeQL |
128 | | -- [ ] https://codeql.github.com |
129 | 154 |
|
130 | | -五、RASP |
| 155 | +**五、RASP** |
131 | 156 | - [ ] https://github.com/0e0w/RASP |
132 | 157 |
|
133 | | -六、JNDI |
| 158 | +**六、JNDI** |
| 159 | + |
134 | 160 | - [ ] https://github.com/HackJava/JNDI |
135 | 161 | - [ ] https://github.com/bradfitz/jndi |
136 | 162 | - [ ] https://github.com/EmYiQing/LDAPKit |
|
146 | 172 | - [ ] https://github.com/zu1k/ldap-log |
147 | 173 | - [ ] https://github.com/orleven/Celestion |
148 | 174 |
|
149 | | -七、Deserialization |
| 175 | +**七、ysoserial** |
150 | 176 | - [ ] https://github.com/wh1t3p1g/ysomap |
151 | 177 | - [ ] https://github.com/frohoff/ysoserial |
152 | 178 | - [ ] https://github.com/KpLi0rn/ysoserial |
|
160 | 186 | - [ ] https://github.com/j1anFen/ysoserial_echo |
161 | 187 | - [ ] https://github.com/EmYiQing/ShortPayload |
162 | 188 |
|
163 | | -八、Monitor |
| 189 | +**八、Monitor** |
164 | 190 | - [ ] https://github.com/TheKingOfDuck/FileMonitor |
165 | 191 | - [ ] https://github.com/TheKingOfDuck/MySQLMonitor |
166 | 192 | - [ ] https://github.com/Lotus6/FileMonitor |
167 | 193 |
|
168 | | -九、IDEA |
| 194 | +**九、IDEA** |
169 | 195 | - [ ] https://github.com/XianYanTechnology/RocB |
170 | 196 | - [ ] https://github.com/momosecurity/momo-code-sec-inspector-java |
171 | 197 | - [ ] https://github.com/XmirrorSecurity/OpenSCA-intellij-plugin |
172 | 198 |
|
173 | | -十、Others |
| 199 | +**十、Others** |
174 | 200 | - [ ] https://github.com/MobSF/mobsfscan |
175 | 201 | - [ ] https://github.com/threedr3am/log-agent |
176 | 202 | - [ ] https://github.com/wh1t3p1g/tabby |
|
201 | 227 | - [ ] https://github.com/hluwa/Wallbreaker |
202 | 228 | - [ ] https://github.com/4ra1n/code-inspector |
203 | 229 |
|
204 | | -## 03-Java安全漏洞环境 |
| 230 | +## 04-Java安全漏洞环境 |
205 | 231 |
|
206 | 232 | 此处收集整理Java安全漏洞研究的一些环境，包括Web环境，应用框架漏洞环境等。 |
207 | 233 |
|
|
237 | 263 | - [ ] https://github.com/pmiaowu/RMITest |
238 | 264 | - [ ] https://github.com/OWASP-Benchmark/BenchmarkJava |
239 | 265 | - [ ] https://github.com/EmYiQing/CIDemo |
240 | | -- [ ] https://github.com/Y4tacker/JavaSec |
241 | 266 | - [ ] https://github.com/javaweb-sec/javaweb-vuls |
242 | 267 | - [ ] https://github.com/LandGrey/SpringBootVulExploit |
243 | 268 | - [ ] https://github.com/linjiananallnt/ElectricRat |
244 | 269 |
|
245 | | -## 04-Java安全漏洞分类 |
246 | | - |
247 | | -- Java反序列化漏洞 |
248 | | -- 任意命令执行漏洞 |
249 | | -- 任意文件上传漏洞 |
250 | | -- 任意文件写入漏洞 |
251 | | -- 任意文件包含漏洞 |
252 | | -- 任意文件删除漏洞 |
253 | | -- SQL注入漏洞 |
254 | | -- 业务逻辑漏洞 |
255 | | -- 变量覆盖漏洞 |
256 | | -- 程序安装问题 |
257 | | -- XSS漏洞 |
258 | | -- XXE漏洞 |
259 | | -- SSRF漏洞 |
260 | | -- CSRF漏洞 |
261 | | - |
262 | | -## 05-Java安全代码审计 |
263 | | - |
264 | | -一、Java安全Web漏洞 |
265 | | -- [ ] https://github.com/ax1sX/SecurityList |
266 | | - |
267 | | -二、Java代码审计实战 |
268 | | - |
269 | | -## 06-Java安全漏洞修复 |
| 270 | +## 05-Java安全漏洞修复 |
270 | 271 |
|
271 | 272 | 一、Java安全编码规范 |
272 | 273 | - [x] [《Java安全编码标准》](https://developer.aliyun.com/article/175341)@计文柯 |
273 | | -- [OWASP 安全编码规范](https://owasp.org/www-pdf-archive/OWASP_SCP_Quick_Reference_Guide_%28Chinese%29.pdf) |
274 | | -- [腾讯-Java安全编码规范](https://github.com/Tencent/secguide/blob/main/Java%E5%AE%89%E5%85%A8%E6%8C%87%E5%8D%97.md) |
275 | | -- [陌陌-Java安全编码规范](https://github.com/momosecurity/rhizobia_J) |
276 | | -- 华为-Java安全编码规范 |
277 | | -- 绿盟-Java安全编码规范 |
278 | | -- 奇安信-Java安全编码规范 |
279 | | -- 软通动力-Java-Web安全开发规范 |
280 | | -- [securitypaper-Java安全编码规范](https://www.securitypaper.org/2.sdl%E8%A7%84%E8%8C%83%E6%96%87%E6%A1%A3/3-java%E5%AE%89%E5%85%A8%E7%BC%96%E7%A0%81%E8%A7%84%E8%8C%83) |
| 274 | +- [ ] [OWASP 安全编码规范](https://owasp.org/www-pdf-archive/OWASP_SCP_Quick_Reference_Guide_%28Chinese%29.pdf) |
| 275 | +- [ ] [腾讯-Java安全编码规范](https://github.com/Tencent/secguide/blob/main/Java%E5%AE%89%E5%85%A8%E6%8C%87%E5%8D%97.md) |
| 276 | +- [ ] [陌陌-Java安全编码规范](https://github.com/momosecurity/rhizobia_J) |
| 277 | +- [ ] 华为-Java安全编码规范 |
| 278 | +- [ ] 绿盟-Java安全编码规范 |
| 279 | +- [ ] 奇安信-Java安全编码规范 |
| 280 | +- [ ] 软通动力-Java-Web安全开发规范 |
| 281 | +- [ ] [securitypaper-Java安全编码规范](https://www.securitypaper.org/2.sdl%E8%A7%84%E8%8C%83%E6%96%87%E6%A1%A3/3-java%E5%AE%89%E5%85%A8%E7%BC%96%E7%A0%81%E8%A7%84%E8%8C%83) |
281 | 282 |
|
282 | 283 | 二、Java安全漏洞修复 |
283 | 284 |
|
284 | | -## 07-Java高危应用框架 |
| 285 | +## 06-Java高危应用框架 |
285 | 286 |
|
286 | 287 | 此处整理收集Java开发的普遍使用的程序：包括中间件、核心框架、底层库、重要应用系统等。待更新。 |
287 | 288 |
|
288 | | -- [Log4j2](https://github.com/HackJava/Log4j2) |
289 | | -- [Shiro](https://github.com/HackJava/Shiro) |
290 | | -- [Weblogic](https://github.com/HackJava/Weblogic) |
291 | | -- MyBatis |
292 | | -- Spring |
| 289 | +- [ ] [Log4j2](https://github.com/HackJava/Log4j2) |
| 290 | +- [ ] [Shiro](https://github.com/HackJava/Shiro) |
| 291 | +- [ ] [Weblogic](https://github.com/HackJava/Weblogic) |
| 292 | +- [ ] MyBatis |
| 293 | +- [ ] Spring |
293 | 294 |
|
294 | | -## 08-Java安全参考资源 |
| 295 | +## 07-Java安全参考资源 |
295 | 296 |
|
296 | 297 | 本人在学习Java安全的过程中遇到了很多优秀的Java安全研究员，感谢这些研究者！排名不分先后。 |
297 | 298 |
|
298 | | -- https://github.com/4ra1n |
299 | | -- https://github.com/phith0n |
300 | | -- https://github.com/su18 |
301 | | -- https://github.com/welk1n |
302 | | -- https://github.com/threedr3am |
303 | | -- https://github.com/Y4er |
304 | | -- https://github.com/wh1t3p1g |
305 | | -- https://xz.aliyun.com/u/44415 |
| 299 | +- [ ] https://github.com/4ra1n |
| 300 | +- [ ] https://github.com/phith0n |
| 301 | +- [ ] https://github.com/su18 |
| 302 | +- [ ] https://github.com/welk1n |
| 303 | +- [ ] https://github.com/threedr3am |
| 304 | +- [ ] https://github.com/Y4er |
| 305 | +- [ ] https://github.com/wh1t3p1g |
| 306 | +- [ ] https://xz.aliyun.com/u/44415 |
306 | 307 |
|
307 | 308 | ## Stargazers |
308 | 309 |
|
|
0 commit comments