# threedr3am/learnjavabug

Java安全相关的漏洞和技术demo，原生Java、Fastjson、Jackson、Hessian2、XML反序列化漏洞利用和Spring、Dubbo、Shiro、CAS、Tomcat、RMI、Nexus等框架\中间件\功能的exploits以及Java Security Manager绕过、Dubbo-Hessian2安全加固等等实践代码。

Repository: https://github.com/threedr3am/learnjavabug
Canonical: https://ross.abutalabs.com/products/learnjavabug
Language: Java
License: MIT
License Family: permissive
Last push: 2024-03-14T15:05:53+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3043, "days_push": 902, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2687, forks 493 (observed 2026-08-28T04:07:10.785627+00:00)

## What it is
A collection of Java security vulnerability demos and exploit proof-of-concepts covering deserialization issues in libraries like Fast, Jackson, and Hessian2, plus exploits for frameworks and middleware such as Spring, Dubbo, Shiro, CAS, and Tomcat. It also includes Java Security Manager bypass techniques and security hardening examples, serving as the author's personal technical notes for security research.

## Use cases
- reproduce fast deserialization RCE vulnerabilities
- learn jackson deserialization exploit gadgets
- study dubbo hessian2 deserialization attacks and hardening
- understand padding oracle CBC attacks in Java
- find exploit demos for Shiro and Spring middleware vulnerabilities
- learn Java Security Manager bypass techniques
- study SSRF and DNS lookup gadgets in JSON deserialization

## When to choose
- you are a security researcher studying Java deserialization vulnerabilities
- you need reference PoC code for fast, jackson, or dubbo exploits
- you want to learn how middleware like Shiro, Tomcat, or CAS are exploited
- you need examples of Java security hardening like hessian2 blacklists

## When to avoid
- you need a production security scanning tool
- you want automated vulnerability detection rather than manual demos
- you are not working with the Java/JVM ecosystem
- you intend to use exploits against systems without authorization

## Facets
- artifact type: learning-resource
- maturity: active
- function: security, penetration-testing, vulnerability-scanning, reverse-engineering, serialization
- domain: security, penetration-testing, developer-tools, tutorials
- platform: jvm, cross-platform
- tags: java-security, deserialization-vulnerabilities, exploit-demos, fast, jackson, dubbo, shiro, vulnerability-research, security-research, poc

## Member repositories
- threedr3am/learnjavabug (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:10.785627+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:17:46.703120+00:00, confidence not recorded.
  - readme: https://github.com/threedr3am/learnjavabug (fetched 2026-08-28T04:07:10.785627+00:00, sha 00db78cac121)
- Data as of 2026-08-30T08:39:29.467469+00:00.