{"id":13575602,"url":"https://github.com/novysodope/javaeasyscan","last_synced_at":"2025-04-04T22:31:36.650Z","repository":{"id":244669253,"uuid":"814530674","full_name":"novysodope/javaeasyscan","owner":"novysodope","description":"javaeasyscanner - 富婆系列，代码审计辅助工具，致力于解放大脑，方便双手","archived":false,"fork":false,"pushed_at":"2024-06-18T02:13:39.000Z","size":165,"stargazers_count":262,"open_issues_count":1,"forks_count":11,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-11-05T11:43:14.014Z","etag":null,"topics":["audit","codeaudi","java"],"latest_commit_sha":null,"homepage":"https://github.com/novysodope/javaeasyscan","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/novysodope.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-06-13T07:34:03.000Z","updated_at":"2024-11-04T10:59:07.000Z","dependencies_parsed_at":"2024-06-16T16:18:34.292Z","dependency_job_id":"5793c6b5-b48e-4a65-9788-d5ecd487f712","html_url":"https://github.com/novysodope/javaeasyscan","commit_stats":null,"previous_names":["novysodope/javaeasyscan"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/novysodope%2Fjavaeasyscan","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/novysodope%2Fjavaeasyscan/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/novysodope%2Fjavaeasyscan/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/novysodope%2Fjavaeasyscan/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/novysodope","download_url":"https://codeload.github.com/novysodope/javaeasyscan/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247260727,"owners_count":20910067,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["audit","codeaudi","java"],"created_at":"2024-08-01T15:01:02.486Z","updated_at":"2025-04-04T22:31:31.624Z","avatar_url":"https://github.com/novysodope.png","language":"Java","funding_links":[],"categories":["Java","代码审计"],"sub_categories":[],"readme":"```bash\n███████╗██╗   ██╗██████╗  ██████╗\n██╔════╝██║   ██║██╔══██╗██╔═══██╗\n█████╗  ██║   ██║██████╔╝██║   ██║\n██╔══╝  ██║   ██║██╔═══╝ ██║   ██║\n██║     ╚██████╔╝██║     ╚██████╔╝\n╚═╝      ╚═════╝ ╚═╝      ╚═════╝\n                       JAVAEASYSCANNER  Fupo's series\n—————————————————————————————————————————————————————\n```\n致力于解放大脑，方便双手\n\n富婆系列，不想努力就用它\n\n# JAVA审计辅助工具\n本工具以辅助审计***Springboot/Springmvc项目为主***，效果更佳\n\n# 使用\njava环境：JDK1.8\n\n本工具的优势在于不用你写规则，所以在打包好项目后（懒得打包的可以直接到这里下载已经打包好的: [releases](https://github.com/novysodope/javaeasyscan/releases)），直接按照以下方式启动即可\n```java\njava -jar javaeasyscan.jar 源码目录（暂不支持反编译class）\n```\n\n## 工具实现思路：\n\n使用反向跟进的方法: `定位漏洞点 ⟶ 定位漏洞所属方法、所属类 ⟶ 往上查找所属类及所属方法被调用的地方 ⟶ 直至没有被调用为止`\n\n**示例:**\n\n有一个SQL注入的场景如下\n```java\n  \u003cselect id=\"selectUser\" resultType=\"com.javavul.javavulpoj.data.SubUsers\"\u003e\n        select * from subusers where id = ${id}\n    \u003c/select\u003e\n```\n首先记录`selectUser`，以及所在的Mappper，根据Mapper配置找到对应的Mapper接口\n```java\n@Mapper\npublic interface ProductMapper {\n\n    List\u003cProduct\u003e selectUser(ProductExample example);\n}\n```\n随后记录`ProductMapper`接口以及`selectUser`方法，接着往上找到调用该接口和方法的地方\n```java\npublic class ProductServiceImpl implements ProductService {\n    @Autowired\n    private ProductMapper productMapper;\n   public List\u003cProduct\u003e  selectUser(ProductExample example) {\n        return productMapper.selectUser(example);\n    }\n```\n随后记录`ProductServiceImpl`类、`selectUser`方法和`ProductService`，然后往前找调用了`ProductService.selectUser`的地方\n```java\n@ResponseBody\n    @RequestMapping(\"/sqlin\")\n    public List sqlin(HttpServletRequest req, HttpServletResponse rep, ProductExample example) throws IOException {\n        String v = req.getParameter(\"sql\");\n        try {\n            List reta = productService.selectUser(example);\n            return ret;\n        } catch (Exception e) {\n           return Collections.singletonList(e.getMessage());\n        }\n    }\n```\n这个跟进的操作会重复到往上再没有调用，且如果mybatis xml文件存在注入写法，但是方法没有被调用，则工具就会忽略该场景\n\n等所有漏洞扫描完后，会在当前目录生成一个***HTML报告***，报告示例：\n\n![image](https://github.com/novysodope/javaeasyscan/assets/45167857/6e299953-fe42-4aa0-b96d-b0786f638655)\n\n![image](https://github.com/novysodope/javaeasyscan/assets/45167857/71e07f90-44d4-4ea8-9e73-74334d5d379e)\n\n# 计划\n因为时间仓促，本工具只写了mybatis的SQL注入、JDBC拼接SQL注入、Fastjson反序列化、Groovy代码执行、命令注入五个模块，目前mybatis的SQL注入模块比较完善\n\n## 后续需要优化的地方：\n- 所有模块增加入参校验，如果参数不可控则忽略场景，减少误报\n- JDBC拼接导致的注入需要增加调用链跟踪（目前只是输出了存在拼接的地方）\n- Fastjson反序列化增加版本检测\n- this.method没有被识别，会影响调用链跟踪\n\n## 后续新增\n- 各种漏洞模块\n- 界面？\n\n# 其他\n- 如果打包没有把依赖打包进去，请查看 [解决maven打jar包时不把依赖打包进去的问题](https://blog.csdn.net/qq_30786785/article/details/125506886)\n- 因为要带项目了，所以要视情况挤时间出来更新，如果你有想法等不及的话可以下载代码改或者加入本项目直接pull更新或者提交issues，我会不定期查看，谢谢\n- 不爱请别伤害，不好的评论我会删\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnovysodope%2Fjavaeasyscan","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnovysodope%2Fjavaeasyscan","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnovysodope%2Fjavaeasyscan/lists"}