Jar Analyzer - 一个 JAR 包 GUI 分析工具，内置 AI 助手协助分析，支持 JAR DIFF 分析，方法调用关系搜索，方法调用链 DFS 算法分析，模拟 JVM 的污点分析验证 DFS 结果，字符串搜索，Java Web 组件入口分析，CFG 程序分析，JVM 栈帧分析，自定义表达式搜索等

bytecode static-analysis java-decompiler jar java-bytecode vulnerability program-analysis java-gui java-security web-vulnerability java-debugger java-asm java-vulnerability

• Updated Oct 29, 2026
• Java

JavaSecLab is a comprehensive Java vulnerability platform｜​ JavaSecLab是一款综合型Java漏洞平台，提供相关漏洞缺陷代码、修复代码、漏洞场景、审计SINK点、安全编码规范，覆盖多种漏洞场景，友好用户交互UI……

java security sdl owasp web-security ctf security-training iast devsecops java-security sast code-audit java-vulnerability vulnerability-lab

• Updated Jun 9, 2026
• Java

🔍 CodeAuditAssistant - JetBrains Code Audit Plugin (Beta) ⚡ Deep Call-Chain Tracking | 🚀 Method/Class Search | 🔥 Prebuilt Vuln Sinks Native Integration | Decompiler/Path Finder | Memory Optimized 🔍 CodeAuditAssistant - IDEA代码审计插件 ⚡ 精准追踪复杂调用链 | 🚀 毫秒级方法搜索 | 🔥 内置高危漏洞检测 原生集成 | 反编译/路径分析 | 内存优化 | 安全审计利器

idea-plugin java-security code-audit

• Updated Mar 14, 2026
• Kotlin

"chanzi" is a simple and user-friendly JAVA SAST tool that utilizes taint analysis technology, includes built-in common vulnerability rules, supports decompile, custom rule, and is compatible with the technology stacks of Servlet&filter, Spring,struts,Dubbo,Thrift, jax-rs,jax-ws,JFinal,Netty,MyBatis,and JSP.

java security static-analysis static-analyzer static-analyzers security-tools java-security sast javasecurity java-code-quality java-scanner java-seckill java-sec javasec static-analysis-tools

• Updated Feb 1, 2026

Java web and command line applications demonstrating various security topics

java security csp cryptography spring spring-boot xss owasp spring-security csrf appsec java-web esapi java-security google-tink security-topics

• Updated Nov 1, 2026
• Java

Java-Web-Security - Sichere Webanwendungen mit Java entwickeln

java java-security

• Updated Nov 12, 2026
• Java

使用JNI加密字节码，通过JVMTI解密字节码以保护代码，支持自定义包名和密钥，使用魔法禁止黑客dump字节码

bytecode jvm java-decompiler jvmti java-security java-obfuscator bytecode-obfuscator java-obfuscation

• Updated Dec 4, 2024
• C

RuoYi (若依) dedicated vulnerability scanner: plugin architecture, three-state verdict, WAF bypass, exploit chains, AI POC generation, nuclei compatible. 若依专项漏洞扫描器

ai owasp penetration-testing sql-injection nuclei cve offensive-security fastjson red-team security-tools devsecops java-security vulnerability-scanner dast cnvd ruoyi waf-bypass ruoyi-vue ruoyi-cloud exploit-chain

• Updated Nov 9, 2026
• Python

基于 RBAC 模型功能全面的 Shiro 安全集成&简化&扩展组件。Shiro integration & simplifies & Extension component based RBAC

java security spring captcha rbac javaee shiro user-controls rights-management redis-session java-security shiro-redis rbac-management easyshiro-shiro login-lock spring-shiro shiro-redis-cache shiro-redis-session

• Updated Aug 13, 2019
• TSQL

Autonomous agent that mines Java deserialization gadget chains from any JAR directory. Static bytecode analysis + dynamic JVM probes + dual-model adversarial auditing → weaponized PoC. Solving the last mile.

static-analysis deserialization penetration-testing rce vulnerability-detection offensive-security security-tools java-security code-audit gadget-chain agentic-ai

• Updated Oct 28, 2026
• Python

Demonstrate how usage of the Java Security Manager can prevent Remote Code Execution (RCE) exploits.

infosec java-security cve-2017-5638 mandatory-access-control java-security-manager

• Updated Dec 3, 2023
• Java

An ongoing collection of java language tools and frameworks, software, libraries, learning tutorials, frameworks, academic and practical resources.

java security java-8 pentesting java-frameworks java-exercises pentest-scripts java-security java-server pentest-tool java-exception java-operator-sdk

• Updated Jul 4, 2022

An ongoing curated list of frameworks, books, articles, talks, screencasts, recordings, libraries, learning tutorials and resources about Java Development.

java java-collections java-apps java-frameworks java-9 java-application java-developer java-security java-codes java-development-kit java-code-best-practices java-development-tools java-17 java-developer-vm

• Updated Mar 25, 2022
• Java

Fast and powerful cryptographic functions thanks to javax.crypto and CommonCrypto.

android api ios cryptography crypto aes native hash pbkdf2 digest commoncrypto flutter implementation java-security javax-crypto

• Updated Apr 5, 2023
• Dart

一个为广大安全人员整合的知识框架，目前会涉及到Web安全、Java安全研究、红蓝对抗、应急响应、APP、SRC、CTF等。

web-security java-security zhi-shi-kuang-jia

• Updated Jun 30, 2022

TuxCare SecureChain enhances Java supply chain security through vetted libraries, vulnerability fixes, and extended support. Ideal for enterprise-level compliance and secure development.

vulnerability-assessment java-security dependency-management software-bill-of-materials sbom enterprise-security open-source-security supply-chain-security compliance-management java-supply-chain-security oss-vulnerability-remediation enterprise-security-compliance java-libraries-vetting java-dependency-management

• Updated Oct 13, 2025

Sample web app to demo end-to-end security w/ JavaEE, Spring Security and RBAC fine-grained authorization. All connections use SSL.

tls ldap tomcat authorization spring-security rbac role-based-access-control ldap-server spring-security-web tls-certificate java-security apache-fortress javaee-security tomcat-security

• Updated Feb 21, 2026
• HTML

Application Intrusion Detection projects

spring-boot java-security application-intrusion-detection appsensor

• Updated Aug 1, 2024
• Java

Tutorial on RBAC role engineering practice using Apache Fortress as the security system inside a sample Apache Wicket Java Web app. Based on this article: http://iamfortress.net/2015/03/05/the-seven-steps-of-role-engineering/

authorization rbac role-based-access-control access-control java-security ansi-incits-359

• Updated Jul 29, 2025
• Java

A PGP end-to-end encrypted generic email client developed for Smart India Hackathon.

security imap smtp aes-encryption rsa-cryptography email-client java-cryptography java-security

• Updated Nov 23, 2017
• Java