Skip to content
View 4ra1n's full-sized avatar
3.2k followers · 235 following

Achievements

Achievement: Pair ExtraordinaireAchievement: QuickdrawAchievement: Starstruckx3Achievement: Pull Shark

Achievements

Achievement: Pair ExtraordinaireAchievement: QuickdrawAchievement: Starstruckx3Achievement: Pull Shark

Highlights

Organizations

@jar-analyzer

Block or report 4ra1n

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
4ra1n/README.md

I am 4ra1n, an independent security researcher

Currently unaffiliated with any company or organization

我是 4ra1n，独立安全研究员，目前无工作

My Blog: https://4ra1n.github.io

My CVE and Acknowledgments: SECURITY-en.md

我获得的 CVE 和致谢信息记录：SECURITY-zh.md

I see 2025 as a turning point in AI’s cybersecurity capabilities

Before then, I discovered 54 CVEs through manual research

I discovered a total of 100+ CVEs in well-known products (some are in disclosure process)

The products include httpd/tomcat/jetty/mysql/jdk/kafka/activemq/weblogic etc.

我认为 2025 年是 AI 安全能力发生质变的拐点

在 2025 年以前的古法时代我发现了 54 个 CVE 漏洞

我共计发现了 100+ 个知名产品的 CVE 漏洞（部分在发布流程中）

涉及到的产品有 httpd/tomcat/jetty/mysql/jdk/kafka/activemq/weblogic 等

Pinned Loading

  1. jar-analyzer/jsd jar-analyzer/jsd Public

    A pure TypeScript/JavaScript decompiler for Java bytecode. Runs in browsers and Node.js — no JVM, WebAssembly, or runtime dependencies.

    TypeScript 22

  2. jar-analyzer/jar-analyzer jar-analyzer/jar-analyzer Public

    Jar Analyzer - 一个 JAR 包 GUI 分析工具，内置 AI 助手协助分析，支持 JAR DIFF 分析，方法调用关系搜索，方法调用链 DFS 算法分析，模拟 JVM 的污点分析验证 DFS 结果，字符串搜索，Java Web 组件入口分析，CFG 程序分析，JVM 栈帧分析，自定义表达式搜索等

    Java 2.2k 201

  3. mysql-fake-server mysql-fake-server Public archive

    纯 Java 实现的 MySQL Fake Server | 支持 GUI 版和命令行版 | 支持反序列化和文件读取的利用方式 | 支持常见的 GADGET 和自定义 GADGET 数据 | 根据目标环境自动生成匹配的 PAYLOAD | 支持 PGSQL 和 DERBY 的利用

    Java 833 96

  4. class-obf class-obf Public

    一个 CLASS 文件混淆工具，支持方法字段参数名引用分析和重命名混淆，支持字符串提取/AES加密运行时解密/整型异或混淆/垃圾代码花指令混淆/错误注解崩溃/特殊字符迷惑用户/反编译器对抗/方法和字段的隐藏等，配置简单，容易上手

    Java 327 26