0xCcSec

vulhub

Pre-Built Vulnerable Environments Based on Docker-Compose

lua-nginx-module

Embed the Power of Lua into NGINX HTTP servers

OneForAll

OneForAll是一款功能强大的子域收集工具

codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

SpringBootVulExploit

SpringBoot 相关漏洞学习资料，利用方法和技巧合集，黑盒安全评估 check list

ShuiZe_0x727

信息收集自动化工具

soot

Soot - A Java optimization framework

http

自己提炼的关于《HTTP权威指南》每章的知识点总结！

Inspeckage

Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)

JSFinder

JSFinder is a tool for quickly extracting URLs and subdomains from JS files on a website.

learnjavabug

Java安全相关的漏洞和技术demo，原生Java、Fastjson、Jackson、Hessian2、XML反序列化漏洞利用和Spring、Dubbo、Shiro、CAS、Tomcat、RMI、Nexus等框架\中间件\功能的exploits以及Java Security Manager绕过、Dubbo-Hessian2安全加固等等实践代码。

HackJava

《Java安全-只有Java安全才能拯救宇宙》Only Java Security Can Save The Universe.

java-sec-code

Java web common vulnerabilities and security code which is base on springboot and spring security

cfr

This is the public repository for the CFR Java decompiler

wooyun-payload

从wooyun中提取的payload，以及burp插件

DongTai-agent-java

Java Agent is a Java application probe of DongTai IAST, which collects method invocation data during runtime of Java application by dynamic hooks.

JavaID

java source code static code analysis and danger function identify prog

--Java

代码审计知识点整理-Java

gadgetinspector

一个利用ASM对字节码进行污点传播分析的静态代码审计应用（添加了大量代码注释，适合大家进行源码学习）。也加入了挖掘Fastjson反序列化gadget chains和SQLInject（JdbcTemplate、MyBatis、JPA、Hibernate、原生jdbc等）静态检测功能。并且加入了很多功能以方便进行漏洞自动化挖掘。

SootTutorial

A step-by-step tutorial for Soot (a Java static analysis framework)

Kcon2021Code

CryptoFucker

A xposed plugin for intercepting crypto parameters from apk files.

code2sec.com

xmind\code\articles for my personal blog 个人博客上的资源备份存储，也是个人分享的汇总

codeql

GitHub Satellite 2020 workshops on finding security vulnerabilities with CodeQL for Java/JavaScript.

log-agent

利用agent hock指定的class，在jar运行周期内，用于跟踪被执行的方法，辅助做一些事情，比如挖洞啊

assets-from-spf

A Python script to parse net blocks & domain names from SPF record

FindClassInJars

个人用于在自动化挖掘gadget时，方便查找gadget chains中class所在jar包，以助于便捷审计测试gadget有效性的那么一个小工具。

springboot-acl-bypass

springboot getRequestURI acl bypass

headless-burp

Provides a suite of Burp extensions and a maven plugin to automate security tests using BurpSuite.

java-servlet-specification-4.0

Java Servlet Specification 4.0 中译本 (Servlet规范中文版)