{"id":13575651,"url":"https://github.com/Whoopsunix/JavaRce","last_synced_at":"2025-04-04T22:31:44.213Z","repository":{"id":192019894,"uuid":"680058417","full_name":"Whoopsunix/JavaRce","owner":"Whoopsunix","description":"Common Exploitation Techniques for Java RCE Vulnerabilities in Real-World Scenarios | 实战场景较通用的 Java Rce 相关漏洞的利用方式","archived":false,"fork":false,"pushed_at":"2025-03-06T05:22:06.000Z","size":586,"stargazers_count":491,"open_issues_count":1,"forks_count":55,"subscribers_count":6,"default_branch":"main","last_synced_at":"2025-03-06T06:26:16.765Z","etag":null,"topics":["command","expression","inject","java","jdbc","jndi","memshell","rce","rceecho","rmi","serialization","vul"],"latest_commit_sha":null,"homepage":"https://github.com/Whoopsunix/JavaRce","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Whoopsunix.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-08-18T08:40:21.000Z","updated_at":"2025-03-06T06:09:07.000Z","dependencies_parsed_at":"2023-09-02T04:34:42.407Z","dependency_job_id":"fddcda66-06eb-4dfa-832d-58c019171303","html_url":"https://github.com/Whoopsunix/JavaRce","commit_stats":null,"previous_names":["whoopsunix/javarce"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Whoopsunix%2FJavaRce","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Whoopsunix%2FJavaRce/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Whoopsunix%2FJavaRce/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Whoopsunix%2FJavaRce/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Whoopsunix","download_url":"https://codeload.github.com/Whoopsunix/JavaRce/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247260779,"owners_count":20910072,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["command","expression","inject","java","jdbc","jndi","memshell","rce","rceecho","rmi","serialization","vul"],"created_at":"2024-08-01T15:01:02.967Z","updated_at":"2025-04-04T22:31:39.201Z","avatar_url":"https://github.com/Whoopsunix.png","language":"Java","readme":"# JavaRce\n\nBy. Whoopsunix\n\n# 0x00 do what?\n\n🚀 对照实战场景梳理较通用的 Java Rce 相关漏洞的利用方式 记录在 [VulnCore](SecVulns/VulnCore) 中，参考 [cwe](https://cwe.mitre.org) 标准构建\n\n🚩 子目录 [VulnCore](SecVulns/VulnCore) 给出 Java 利用方式，具体覆盖量见对应 README.md 文件\n\n⛳️ 配套测试靶场 [SecVulns](SecVulns) 主要针对 DevSecOps 场景构建（IAST、RASP、SAST），采用 [httpREST](SecVulns/SecVulnsREST) 实现批量测试。大多数 Java 靶场都把注意力集中在 Spring、Tomcat 组件上，之后会引入更多组件丰富 Source 点 \n\n🪝 EXP: 反序列化框架 [PPPYSO](https://github.com/Whoopsunix/PPPYSO) 集成了部分内容\n\n🚧 Protection: [PPPRASP](https://github.com/Whoopsunix/PPPRASP) 基于 [jvm-sandbox](https://github.com/alibaba/jvm-sandbox) 对 VulnCore 中的漏洞实现防护（仅实现关键函数的 HOOK，不作进一步处理）\n\n🛰 Detection: 基于 [joern](https://github.com/joernio/joern) 实现漏洞检测\n\n# PS\n\n因为是漏洞测试环境，难免会引入部分没法直接拉取的依赖（太老了中央仓库移除、或者没有魔法上网）\n\n可以到 https://mvnrepository.com/ 手动下载 jar 包到本地 maven 仓库\n\n举个例子 下载 [c3p0 0.9.5.2](https://mvnrepository.com/artifact/com.mchange/c3p0/0.9.5.2) 依赖放到本地的  `/.m2/repository/com/mchange/c3p0/0.9.5.2` 目录下\n\n# Stats\n\n![Alt](https://repobeats.axiom.co/api/embed/818a4d2c0d1562eec751b2637b825b3b0d2cf0e3.svg \"Repobeats analytics image\")\n\n[//]: # ([![Stargazers over time]\u0026#40;https://starchart.cc/Whoopsunix/JavaRce.svg\u0026#41;]\u0026#40;https://starchart.cc/Whoopsunix/JavaRce\u0026#41;)\n","funding_links":[],"categories":["Java","红队\u0026渗透测试"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FWhoopsunix%2FJavaRce","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FWhoopsunix%2FJavaRce","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FWhoopsunix%2FJavaRce/lists"}