java-auth-audit

160

RuoJi6

Java Web 源码鉴权机制审计工具。从源码中识别所有鉴权实现并分析安全风险。适用于：(1) 识别鉴权框架和实现方式，(2) 发现鉴权绕过漏洞，(3) 分析越权访问风险，(4) 审计权限校验逻辑。支持 Shiro、Spring Security、JWT、Filter/Interceptor、自定义鉴权等。**支持反编译 .class/.jar 文件提取鉴权逻辑**。结合 java-route-mapper 使用可实现完整的路由+鉴权审计。

java-route-mapper

160

RuoJi6

Java Web source-code routing and parameter-mapping analysis tool. Extracts **all** HTTP routes and parameters from source code, generates complete Burp Suite request templates, and automatically saves them as MD documents. Suitable for: (1) fully mapping interfaces for projects without API documentation, (2) generating Burp test requests for all endpoints, (3) comprehensive endpoint analysis from source code. Supports frameworks such as Spring MVC, Servlet, JAX-RS, Struts 2, CXF Web Services, and more. **Must output all interfaces without omission, including the complete SOAP methods of Web Services.**