feihong

TerraformGoat. TerraformGoat is HXSecurity research lab's "Vulnerable by Design" multi cloud deployment tool.

chrome-extensions-samples. Chrome Extensions Samples

jazzer. Coverage-guided, in-process fuzzing for the JVM

momo-code-sec-inspector-java. IDEA静态代码安全审计及漏洞一键修复插件

malicious-pdf. 💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh

codeql. CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

kubernetes-goat. Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀

codeql_grehack_workshop. GreHack 2021 CodeQL for Java workshop

docker-images. Official source of container configurations, images, and examples for Oracle products and projects

toBeBetterJavaer. 一份通俗易懂、风趣幽默的Java学习指南，内容涵盖Java基础、Java并发编程、Java虚拟机、Java企业级开发、Java面试等核心知识点。学Java，就认准二哥的Java进阶之路😄

javaparser. Java 1-25 Parser and Abstract Syntax Tree for Java with advanced analysis functionalities.

JDKSourceCode1.8. Jdk1.8源码解析

dnsFookup. DNS rebinding toolkit

JDBC-Attack. JDBC Connection URL Attack

prototype-pollution-exploits. Prototype Pollution exploits collection

client-side-prototype-pollution. Prototype Pollution and useful Script Gadgets

regexploit. Find regular expressions which are vulnerable to ReDoS (Regular Expression Denial of Service)

nuclei. Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

Fastjson. Fastjson姿势技巧集合

weblogic-infodetector. woodpecker框架weblogic信息探测插件

sec-dev-in-action-src. 《白帽子安全开发实战》配套代码

Sreg. Sreg可对使用者通过输入email、phone、username的返回用户注册的所有互联网护照信息。

SpringBoot-Labs. 一个涵盖六个专栏：Spring Boot 2.X、Spring Cloud、Spring Cloud Alibaba、Dubbo、分布式消息队列、分布式事务的仓库。希望胖友小手一抖，右上角来个 Star，感恩 1024

spring-boot-upload-file-lead-to-rce-tricks. spring boot Fat Jar 任意写文件漏洞到稳定 RCE 利用技巧

SerialKiller. Look-Ahead Java Deserialization Library

AgentMemShellScanner. 清除基于java agent木马

BehinderClientSource. ❄️冰蝎客户端源码-V4.0.6🔞

log-agent. 利用agent hock指定的class，在jar运行周期内，用于跟踪被执行的方法，辅助做一些事情，比如挖洞啊

cas-sample-java-webapp. Sample Java web app protected by Java CAS client

learnjavabug. Java安全相关的漏洞和技术demo，原生Java、Fastjson、Jackson、Hessian2、XML反序列化漏洞利用和Spring、Dubbo、Shiro、CAS、Tomcat、RMI、Nexus等框架\中间件\功能的exploits以及Java Security Manager绕过、Dubbo-Hessian2安全加固等等实践代码。

bylibrary. 白阁文库是白泽Sec安全团队维护的一个漏洞POC和EXP公开项目

CobaltStrike4.0_related. 破解的cs4.0、cs4.0官方手册翻译和一些笔记

DongTai-agent-java. Java Agent is a Java application probe of DongTai IAST, which collects method invocation data during runtime of Java application by dynamic hooks.

ZhouYu. （周瑜）Java - SpringBoot 持久化 WebShell（不仅仅是SpringBoot，适合任何符合JavaEE规范的服务）

freddy. Automatically identify deserialisation issues in Java and .NET applications by using active and passive scans

Goby. Attack surface mapping

vulmap. Vulmap 是一款 web 漏洞扫描和验证工具, 可对 webapps 进行漏洞扫描, 并且具备漏洞验证功能

bestJavaer. 现在这个 repo 它已转型为 cxuan-ai-labs：一个普通开发者在 AI 时代的个人实验室，用来记录 AI 文章、工具资源、Agent 实验、模型观察、踩坑复盘，以及一些未必成熟但真实有趣的 AI 作品。旧 Java 内容已归档保留，新主线转向 AI。

My-Presentation-Slides. Collections of Orange Tsai's public presentation slides.

javaSerializationTools. Python

vue-admin-template. a vue2.0 minimal admin template

CVE-2021-3156. C

vueDemo. Vue

awesome-vue. 🎉 A curated list of awesome things related to Vue.js

Active-Directory-Exploitation-Cheat-Sheet. A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

HaE. HaE - Highlighter and Extractor, Empower ethical hacker for efficient operations. 赋能白帽，高效作战！

JavaSecurity. Java web and command line applications demonstrating various security topics

redteam_vul. 红队作战中比较常遇到的一些重点系统漏洞整理。

BurpSuiteHTTPSmuggler. A Burp Suite extension to help pentesters to bypass WAFs or test their effectiveness using a number of techniques

abuse-ssl-bypass-waf. Bypassing WAF by abusing SSL/TLS Ciphers

bayonet. bayonet是一款src资产管理系统，从子域名、端口服务、漏洞、爬虫等一体化的资产管理系统

wafw00f. WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.

As-Exploits. 中国蚁剑后渗透框架

GetIPinfo. 用于寻找多网卡主机方便内网跨网段渗透避免瞎打找不到核心网

Sublist3r. Fast subdomains enumeration tool for penetration testers

BypassAntiVirus. 远控免杀系列文章及配套工具，汇总测试了互联网上的几十种免杀工具、113种白名单免杀方式、8种代码编译免杀、若干免杀实战技术，并对免杀效果进行了一一测试，为远控的免杀和杀软对抗免杀提供参考。

JavaThings. Share Things Related to Java - Java安全漫谈笔记相关内容

SerializationDumper. A tool to dump Java serialization streams in a more human readable form.

MySQL_Fake_Server. MySQL Fake Server use to help MySQL Client File Reading and JDBC Client Java Deserialize

rhizobia_J. JAVA安全SDK及编码规范

BurpShiroPassiveScan. 一款基于BurpSuite的被动式shiro检测插件

Apache-Solr-RCE. Apache Solr Exploits 🌟

java-memshell-scanner. 通过jsp脚本扫描java web Filter/Servlet型内存马

Kernelhub. :palm_tree:Linux、macOS、Windows Kernel privilege escalation vulnerability collection, with compilation environment, demo GIF map, vulnerability details, executable file (提权漏洞合集)

SharpChromium. .NET 4.0 CLR Project to retrieve Chromium data, such as cookies, history and saved logins.

xray-crack. xray社区高级版证书生成，仅供学习研究，正常使用请支持正版。removed due to Chaitin requirements & support to version 1.4.4 & learning purpose

JavaTools. 一些Java编写的小工具。

javaagent-tomcat-memshell. 使用java agent反序列化注入内存shell

Rogue-MySql-Server. Rogue MySql Server

ysoserial.net. Deserialization payload generator for a variety of .NET formatters

yaml-payload. Spring Cloud SnakeYAML 反序列化一键注入cmdshell和reGeorg

memShell. a webshell resides in the memory of java web server

icmpsh. Simple reverse ICMP shell

BurpSuite-collections. 有关burpsuite的插件(非商店),文章以及使用技巧的收集(此项目不再提供burpsuite破解文件,如需要请在博客mrxn.net下载)---Collection of burpsuite plugins (non-stores), articles and tips for using Burpsuite, no crack version file

J2EEScan. J2EEScan is a plugin for Burp Suite Proxy. The goal of this plugin is to improve the test coverage during web application penetration tests on J2EE applications.

Penetration_Testing_POC. 渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypass oa-getshell cve-cms

CVE-2020-1472. PoC for Zerologon - all research credits go to Tom Tervoort of Secura

attackRmi. attackRmi

FastjsonScan. 一个简单的Fastjson反序列化检测burp插件

WeblogicEnvironment. Weblogic环境搭建工具

Demo-Exploit-Jackson-RCE. Exploiting CVE-2017-7525 demo project with Angular7 frontend and Spring.

shiroPoc. Java

FastjsonPocs. 一些结合第三方组件的Fastjson POC，在1.2.48以后版本中陆续被添加至黑名单。

Empire. Empire is a PowerShell and Python post-exploitation agent.

springboot-analysis. 🍃 something about springboot

Java-Deserialization-Cheat-Sheet. The cheat sheet about Java Deserialization vulnerabilities

CodeGuide. :books: 本代码库是作者小傅哥多年从事一线互联网 Java 开发的学习历程技术汇总，旨在为大家提供一个清晰详细的学习教程，侧重点更倾向编写Java核心内容。如果本仓库能为您提供帮助，请给予支持(关注、点赞、分享)！

xxe-lab. 一个包含php,java,python,C#等各种语言版本的XXE漏洞Demo

JNDI-Exploit-Bypass-Demo. Demo code for post <Restrictions of JNDI Manipulation RCE & Bypass>

SRC-experience. 工欲善其事，必先利其器

RMIDeserialize. RMI 反序列化环境 一步步

JNDI-Injection-Exploit. JNDI注入测试工具（A tool which generates JNDI links can start several servers to exploit JNDI Injection vulnerability,like Jackson,Fastjson,etc）

pwn_jenkins. Notes about attacking Jenkins servers

JavaLearnVulnerability. Java漏洞学习笔记 Deserialization Vulnerability

JavaFamily. 【Java面试+Java学习指南】 一份涵盖大部分Java程序员所需要掌握的核心知识。

BypassAV. Cobalt Strike插件，用于快速生成免杀的可执行文件

ActuatorExploitTools. 一款用于攻击spring boot actuator的集成环境，目前集成三种攻击方式，支持1.x、2.x

SerialKillerBypassGadgetCollection. Collection of bypass gadgets to extend and wrap ysoserial payloads

exphub. Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340

jdk8u_jdk. Java

BurpCrypto. BurpCrypto is a collection of burpsuite encryption plug-ins, support AES/RSA/DES/ExecJs(execute JS encryption code in burpsuite). 支持多种加密算法或直接执行JS代码的用于爆破前端加密的BurpSuite插件

ysoserial. forked from frohoff/ysoserial and added my own payloads.

java-object-searcher. java内存对象搜索辅助工具

behinder_source. Behinder3.0 Beta4 源码（Decompile and Fixed）

my-presentation-slide.

JSP-WebShells. Collect JSP webshell of various implementation methods. 梳理和发现的JSP Webshell各种姿势

Security-List. If you have any good suggestions or comments during the search process, please feedback some index experience in issues. Thank you for your participation.查阅过程中，如果有什么好的意见或建议，请在Issues反馈，感谢您的参与。

weblogicScanner. weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力：CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252、CVE-2019-2618、CVE-2019-2725、CVE-2019-2729、CVE-2019-2890、CVE-2020-2551、CVE-2020-14750、CVE-2020-14882、CVE-2020-14883

SuperWordlist. 基于实战沉淀下的各种弱口令字典

CVE-2020-0796-RCE-POC. CVE-2020-0796 Remote Code Execution POC

SpringBootVulExploit. SpringBoot 相关漏洞学习资料，利用方法和技巧合集，黑盒安全评估 check list

SB-Actuator. Spring Boot Actuator未授权访问【XXE、RCE】单/多目标检测

shelling. SHELLING - a comprehensive OS command injection payload generator

rogue-jndi. A malicious LDAP server for JNDI injection attacks

fastjson-blacklist. Java

FastjsonExploit. Fastjson vulnerability quickly exploits the framework（fastjson漏洞快速利用框架）

jndi_tool. JNDI服务利用工具 RMI/LDAP，支持部分场景回显、内存shell，高版本JDK场景下利用等，fastjson rce命令执行，log4j rce命令执行 漏洞检测辅助工具

marshalsec. Java

ysoserial. A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.