https://y4tacker.github.io/2023/12/27/year/2023/12/Apache-OFBiz%E6%9C%AA%E6%8E%88%E6%9D%83%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%B5%85%E6%9E%90-CVE-2023-51467/

CodeQL

师傅可能在编译的时候还会遇到一些问题，然而新版本的 CodeQL 对于 Java 已经不需要编译了

CodeQL 入门

CodeQL 官方文档学习

用CodeQL分析漏洞_CVE-2022-42889 | l3yx's blog

漏洞挖掘

Tabby 的使用：https://github.com/wh1t3p1g/tabby

后记

感觉现在 go 用的真的很多，java 系列可能暂时断更了，或许在不久的将来会出一个 golangSecurityLearning

交流群

随着点 Star 的师傅越来越多，希望给师傅们提供一个交流的平台同时平常有一些师傅会加我好友问问题，问的人越来越多，于是决定建个群，也可以让师傅们在群里交流。（希望以后会写 golang 的 SecurityLearning）

可加 VX DrunkbabySec

Extension points exported contracts — how you extend this code

CustomTest (Interface)

@author mbechler [15 implementers]

JavaSecurity/ysoserial改写/ysoserial/src/test/java/ysoserial/test/CustomTest.java

UserDao (Interface)

(no doc) [11 implementers]

JavaSecurity/Spring/SpringLearn/SpringBasicLearning/IoC_Learn/src/main/java/DAO/UserDao.java

RemoteObj (Interface)

(no doc) [9 implementers]

JavaSecurity/JDK/JEP290/RMIServer/src/main/java/RemoteObj.java

IReceiver (Interface)

(no doc) [6 implementers]

JavaSecurity/Java Basic/Java 设计模式/Java-Design-Mode/Design-Principle/src/DependencyInversion/DependencyInversion2.java

Sex (Interface)

(no doc) [6 implementers]

JavaSecurity/Jackson/JacksonBasic/src/main/java/com/drunkbaby/defaultTyping/object_and_non_concrete/Sex.java

Rent (Interface)

(no doc) [3 implementers]

JavaSecurity/反序列化基础/Reappearance/Serialable/src/JdkProxy/StaticProxy/Rent.java

IPerson (Interface)

(no doc) [2 implementers]

JavaSecurity/XStream/XStream/XStream-Basic/src/main/java/IPerson.java

UserService (Interface)

(no doc) [1 implementers]

JavaSecurity/Apache/Shiro/CVE-2021-41303/src/main/java/shiro/service/UserService.java

Core symbols most depended-on inside this repo

call

called by 325

JavaSecurity/ysoserial改写/ysoserial/src/main/java/ysoserial/Serializer.java

setAccessible

called by 305

JavaSecurity/ysoserial改写/ysoserial/src/main/java/ysoserial/payloads/util/Reflections.java

add

called by 107

JavaSecurity/JDK/JMX/src/main/java/org/example/HelloWorldMBean.java

newInstance

called by 94

JavaSecurity/ysoserial改写/ysoserial/src/main/java/ysoserial/payloads/util/Reflections.java

write

called by 77

JavaSecurity/ysoserial改写/ysoserial/src/main/java/ysoserial/payloads/Wicket1.java

writeObject

called by 77

JavaSecurity/Trick/反序列化绕WAF/UTF8Deserialize/src/main/java/org/example/Evil.java

getName

called by 72

JavaSecurity/JDK/JMX/src/main/java/org/example/HelloWorldMBean.java

setFieldValue

called by 65

JavaSecurity/ysoserial改写/ysoserial/src/main/java/ysoserial/payloads/util/Reflections.java

Shape

Method 2,079

Class 828

Function 111

Interface 54

Enum 2

Languages

Java96%

TypeScript3%

Python1%

C1%

Modules by API surface

JavaSecurity/Spring/SpringBootLearn/SpringSecurity/src/main/resources/static/qinjiang/js/jquery-3.1.1.min.js85 symbols

JavaSecurity/Apache/ActiveMQ/Pkg-CVE-2023-46604/CVE-2023-46604/src/main/java/org/apache/activemq/transport/tcp/TcpTransport.java62 symbols

JavaSecurity/Apache/ActiveMQ/Pkg-CVE-2023-46604/CVE-2023-46604-Client/src/main/java/org/apache/activemq/transport/tcp/TcpTransport.java62 symbols

JavaSecurity/ysoserial改写/ysoserial/src/main/java/ysoserial/secmgr/DelegateSecurityManager.java30 symbols

JavaSecurity/ysoserial改写/ysoserial/src/main/java/ysoserial/exploit/JBoss.java28 symbols

JavaSecurity/Java Basic/Java 设计模式/Java-Design-Mode/Design-Principle/src/InterfaceSegregation/Segregation1.java27 symbols

JavaSecurity/Java Basic/Java 设计模式/Java-Design-Mode/Design-Principle/src/InterfaceSegregation/improve/Segregation2.java26 symbols

JavaSecurity/Java 代码审计/CodeReview/JavaSec-Code/SSRF/src/main/java/com/drunkbaby/config/WebConfig.java23 symbols

JavaSecurity/ysoserial改写/ysoserial/src/test/java/ysoserial/test/payloads/PayloadsTest.java21 symbols

JavaSecurity/ysoserial改写/ysoserial/src/test/java/ysoserial/test/payloads/MyfacesTest.java18 symbols

JavaSecurity/Spring/SpringLearn/SpringBasicLearning/Spring-04-DI/src/main/java/com/drunkbaby/pojo/Student.java18 symbols

JavaSecurity/Java 代码审计/CodeReview/JavaSec-Code/SSRF/src/main/java/com/drunkbaby/security/SocketHookImpl.java17 symbols

Datastores touched

(mysql)Database · 1 repos

mybatisDatabase · 1 repos

java_sec_codeDatabase · 1 repos

mp_testDatabase · 1 repos

shiro02Database · 1 repos

For agents

$ claude mcp add JavaSecurityLearning \
  -- python -m otcore.mcp_server <graph>

⬇ download graph artifact