# Maskhe/javasec

自己学习java安全的一些总结，主要是安全审计相关

Repository: https://github.com/Maskhe/javasec
Canonical: https://ross.abutalabs.com/products/maskhe-javasec
License: MIT
License Family: permissive
Last push: 2022-01-05T09:52:27+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 2571, "days_push": 1701, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1704, forks 213 (observed 2026-08-28T04:05:24.684256+00:00)

## What it is
A Chinese-language collection of study notes and tutorials on Java security and code auditing, covering topics like reflection, deserialization vulnerabilities, JNDI injection, RMI attacks, XXE, and JVM fundamentals. It is organized as a series of markdown articles with real-world CVE case studies such as fast, Weblogic, and Apache Dubbo vulnerabilities.

## Use cases
- learn java security auditing from scratch
- understand java deserialization vulnerabilities and pop gadget chains
- study how fast and weblogic cves work
- learn jndi injection and rmi attack techniques
- understand xxe vulnerabilities and defenses in java xml parsers
- review jvm internals like class loading and bytecode for security research
- find a structured java security learning roadmap

## When to choose
- you want concise, beginner-friendly explanations of java security concepts
- you are studying for a security auditing or penetration testing role focused on java applications
- you want real-world vulnerability case studies alongside theory

## When to avoid
- you need an up-to-date reference covering the latest vulnerabilities, as the last update was in 2022
- you need comprehensive coverage of every topic, since several planned sections like SQL injection and SSRF remain incomplete
- you need English-language material

## Facets
- artifact type: learning-resource
- maturity: maintenance
- function: security, documentation, developer-tools
- domain: security, tutorials, developer-tools, programming-languages
- platform: jvm, cross-platform
- tags: java-security, security-audit, deserialization, vulnerability-analysis, jvm, jndi-injection, xxe, rmi, chinese-language

## Member repositories
- Maskhe/javasec (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:24.684256+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:37:34.061283+00:00, confidence not recorded.
  - readme: https://github.com/Maskhe/javasec (fetched 2026-08-28T04:05:24.684256+00:00, sha 48b52bb9cbed)
- Data as of 2026-08-30T08:39:29.467469+00:00.