{"id":28113110,"url":"https://github.com/jvm-rasp/jrasp-agent","last_synced_at":"2025-05-14T05:06:12.103Z","repository":{"id":39717495,"uuid":"425453043","full_name":"jvm-rasp/jrasp-agent","owner":"jvm-rasp","description":"专注于JVM的运行时防御系统RASP","archived":false,"fork":false,"pushed_at":"2024-06-14T06:37:15.000Z","size":20901,"stargazers_count":277,"open_issues_count":4,"forks_count":67,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-01-26T02:11:43.662Z","etag":null,"topics":["agent","asm","dynamic","hotupdate","java","java-agent","jvm","module","rasp"],"latest_commit_sha":null,"homepage":"https://www.jrasp.com","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jvm-rasp.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-11-07T09:44:17.000Z","updated_at":"2024-12-10T03:43:42.000Z","dependencies_parsed_at":"2023-10-17T06:20:50.536Z","dependency_job_id":"6aaf7df1-34ed-4baf-8d83-f7c014315a22","html_url":"https://github.com/jvm-rasp/jrasp-agent","commit_stats":null,"previous_names":[],"tags_count":11,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jvm-rasp%2Fjrasp-agent","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jvm-rasp%2Fjrasp-agent/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jvm-rasp%2Fjrasp-agent/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jvm-rasp%2Fjrasp-agent/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jvm-rasp","download_url":"https://codeload.github.com/jvm-rasp/jrasp-agent/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254076848,"owners_count":22010611,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["agent","asm","dynamic","hotupdate","java","java-agent","jvm","module","rasp"],"created_at":"2025-05-14T05:01:29.649Z","updated_at":"2025-05-14T05:06:12.086Z","avatar_url":"https://github.com/jvm-rasp.png","language":null,"funding_links":[],"categories":["安全","Others"],"sub_categories":[],"readme":"# jrasp-agent\n\n![Build Status](https://img.shields.io/badge/Build-passing-brightgreen)\n![Version](https://img.shields.io/badge/Version-1.1.5-informational)\n![Go Guild Version](https://img.shields.io/badge/Go-v1.19.6+-blue)\n![Maven Version](https://img.shields.io/badge/Maven-v3.8.0-blue)\n![Java Build Version](https://img.shields.io/badge/Java-v1.6+-blue)\n![License](https://img.shields.io/badge/License-LGPL3.0-informational)\n![install](https://img.shields.io/badge/install-20000%2B-yellowgreen)\n![platform](https://img.shields.io/badge/platform-linux%7CmacOS%7Cwindows-success)\n\n## 01 Project introduction [中文说明](README_ch.md)\n\n_Java Runtime Application Self Protection_ means Java application self-protection system, which is called 'jrasp' for short.\n\njrasp-agent is the core part of jrasp project.\n\njrasp-agent based on Java Agent technology, modifies Java bytecode, adds security detection logic, detects and blocks vulnerability attacks in real time.\n\n## 02 Characteristics\n\n### Functional characteristics\n\n- Security plug-in can be customized\n- Detection logic low delay\n- Plug in Hot Update\n- Java Process Identification and Automatic Injection\n- Support native method hooks such as command execution to completely prevent bypassing;\n- Compatible with Windows, Mac and Linux\n- Small size, core jar package 600KB\n\n### Performance\n- Increase CPU by 5% (test under normal request)\n- Memory consumption below 200MB\n\n### Self security\n\n- Plug in and daemon HASH verification\n- Agent and Daemon socket customized communication protocol and RSA asymmetric encryption;\n- The core functions are loaded by custom class loaders and isolated from business classes, which improves the difficulty of attacking RASP from within the JVM;\n- Reflection reinforcement: RASP core methods (such as unloading, degradation, etc.) reflect reinforcement to prevent malicious reflection;\n- Do not use third-party frameworks, such as servlet, json, sl4j2, apache common, etc\n\n### Security module\n\nSecurity module of jrasp agent\nThe currently supported modules are:\n- Command execution module (native)\n- Deserialization module (jdk deserialization/fastjson/yaml/stream)\n- HTTP module (springboot/tomcat/jetty/underwown/spark) (IP blacklist/URL blacklist/scanner identification)\n- xxe module (dom4j/jdom/jdk)\n- File access module (io/nio)\n- Expression injection module (spel/ognl)\n- SQL injection (mysql)\n- JNDI injection\n- SSRF\n- shiro\n\nunder development:\n\n- danger protocol\n- DNS query \n- Memory \n- Class loader \n- attach\n\n### Supported jdk versions\n\n+ jdk6+\n\njdk11+ `--add-opens=java.base/java.lang=ALL-UNNAMED`\n\n## 03 Install (centos)\n\n[how to install](https://www.jrasp.com/guide/install/v1.1.2/jrasp-agent.html)\n\n## 04 develop \u0026 Compilation (Source code only available from partners)\n\nDue to the high number of installations of this product, based on product safety considerations, no longer open source code, partners can provide jrasp basic framework source code\n\n## 05 Version record\n\n[RELEASE](CHANGELOG.md)\n\n## 06 Wechat\n\nwx：hycsxs\n\n## 07 Official website\n\nhttps://www.jrasp.com\n\n## 08 Explanation\n\n+ Based on the open source project [jvm-sandbox](https://github.com/alibaba/jvm-sandbox)\n\n+ the hook class/method part from [open-rasp](https://github.com/baidu/openrasp)\n## 09 Users\n\nIf you are using it, please contact us and add it here.\n\n## 10 Copyright Information\n\nGPL3.0（You can learn and use in your own projects, other actions must be authorized)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjvm-rasp%2Fjrasp-agent","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjvm-rasp%2Fjrasp-agent","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjvm-rasp%2Fjrasp-agent/lists"}