Y4tacker

a rep for documenting my study, may be from 0 to 0.1

2023白帽补天大会部分代码

docker运行cs4.7server端

备份下比赛附件

A durable blackboard runtime for verifiable Claude Code agent loops.

only 5 characters to rce

Review-gated image-based PPT generation for Codex

记录学习codeql的过程

my websites

No description.

《Java安全-只有Java安全才能拯救宇宙》Only Java Security Can Save The Universe.

No description.

Weblogic环境搭建工具

关于ThinkPHP框架的历史漏洞分析集合

强网杯十六万行代码自动获得POP链

Use Hive to hijack a Hadoop cluster+

通过线程注入及-race参数免杀全部VT

POC for Spring Kafka Deserialization Vulnerability CVE-2023-34040

backup

No description.

实训项目

JDBC Connection URL Attack

《Spring漏洞学习》

self

A cheat sheet that contains advanced queries for SQL Injection of all types.

四川大学本科、硕士、博士论文LaTeX模版

Fastjson姿势技巧集合

redis ssrf gopher generater && redis ssrf to rce by master-slave-sync

Killer Agent

在原有yso基础上实现依赖分离，内存马注入等功能。A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

User-friendly Desktop Client App for AI Models/LLMs (GPT, Claude, Gemini, Ollama...)

Collect JSP webshell of various implementation methods. 收集JSP Webshell的各种姿势

No description.

各种安全相关思维导图整理收集

struts2 漏洞环境源代码

云环境利用框架 Cloud Exploitation Framework 方便红队人员在获得 AK 的后续工作

A JSP backdoor that enables under Tomcat hiding arbitrary JSP files, in addition to their access logs.

Cobalt Strike系列

SpringBoot 相关漏洞学习资料，利用方法和技巧合集，黑盒安全评估 check list

my website Comments

log4j2-vaccine

A malicious LDAP server for JNDI injection attacks

HaE - BurpSuite Highlighter and Extractor

Milvus is a high-performance, cloud-native vector database built for scalable vector ANN search

No description.

MineContext is your proactive context-aware AI partner（Context-Engineering+ChatGPT Pulse）

What does gpt-oss tell us about OpenAI's training data?

LLM-powered framework for deep document understanding, semantic retrieval, and context-aware answers using RAG paradigm.

A CAT called tabby ( Code Analysis Tool )

chat log tool, easily use your own chat data. 聊天记录工具，轻松使用自己的聊天数据

No description.

No description.

websocket cmd内存马 wscmd.jsp websocket 代理内存马 wsproxy.jsp

PHP binary bugs advisory

Rogue MySql Server

Utils

No description.

mysql蜜罐，获取攻击者微信。公众号：台下言书

源代码漏洞の审计

shiro反序列化漏洞综合利用,包含（回显执行命令/注入内存马）修复原版中NoCC的问题 https://github.com/j1anFen/shiro_attack

java内存对象搜索辅助工具

（周瑜）Java - SpringBoot 持久化 WebShell 学习demo（不仅仅是SpringBoot，适合任何符合JavaEE规范的服务）

构造字节在ASCII范围内的jar

heapdump敏感信息查询工具，例如查找 spring heapdump中的密码明文，AK,SK等

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

JNDI注入测试工具（A tool which generates JNDI links can start several servers to exploit JNDI Injection vulnerability,like Jackson,Fastjson,etc）

Java After-Deserialization Attack

给woodpecker框架量身定制的ysoserial

PaddingZip is a tool that you can craft a zip file that contains the padding characters between the file content.

JNDI 注入利用工具

A deflate compressor that emits compressed data that is in the [A-Za-z0-9] ASCII byte range.

通过jsp脚本扫描java web Filter/Servlet型内存马

No description.

No description.

JavaAgent内存马

分享几个直接可用的内存马，记录一下学习过程中看过的文章

Rogue-MySql-Server

Windows Elevation(持续更新)

Share Things Related to Java - Java安全漫谈笔记相关内容

PHP7内核剖析

No description.

【Java工程师面试复习指南】本仓库涵盖大部分Java程序员所需要掌握的核心知识，整合了互联网上的很多优质Java技术文章，力求打造为最完整最实用的Java开发者学习指南，如果对你有帮助，给个star告诉我吧，谢谢！

No description.

js配合html2canvas和canvas2image将dom元素转化成图片