漏洞知识库
点击放大
DongTai - Dongtai IAST is an open-source Interactive Applica
项目说明
DongTai
![django-project]()
![license Apache-2.0]()
![GitHub release]()
![GitHub release]()
![GitHub release]()
![GitHub release]()
![GitHub release]()
![GitHub release]()
![GitHub release]()
中文版本(Chinese )
About DongTai IAST
Dongtai IAST is an open-source Interacti Security Testing (IAST) tool that enables real-time detection of common in Ja and third-party components through passi. It is particularly suitable for use in the testing phase of the de pipeline.
Project structure
Architecture
DongTai IAST has multiple basic services, including DongTai-web, DongTai， agent, DongTai-Base-Image and DongTai-Plugin-IDEA:
DongTai-web is the product page of DongTai, which is used to handle the interaction between users and ca.DongTai>>dongtai_web is responsible for handling user-related operations.DongTai>>dongtai_protocol is used to process the registration/heartbeat/call method/third-party component/error log data reported by agent, issue hook strategy, issue probe control commands, etc.DongTai>>dongtai_engine analyzes whether there are in HTTP/HTTPS/RPC requests according to the calling method data and taint tracking algorithm, and is also responsible for other related timing tasks.agent is a probe module of DongTai, including data collection terminals in different programming languages, used to collect data during application runtime and report to the DongTai-OpenAPI service.DongTai>>deploy is used for the deployment of DongTai IAST, including docker-compose single-node deployment, Kubernetes cluster deployment, etc. If you want a deployment plan, you can add features or contribute to the deployment plan.DongTai-Base-Image contains the basic services that DongTai depends on runtime, including MySql, Redis.DongTai-Plugin-IDEA is the IDEA plug-in corresponding to the Ja. You can run the Ja directly through the plug-in and detect the directly in IDEA.Scenario
The usage scenarios of "DongTai IAST" include but not limited to:
De process to realize automatic detection of application /third-party component combing/third-party component detection.Quick start
DongTai IAST supports SaaS Service and Localized Deployment. Please refer to Deployment Document for localized deployment.
1. SaaS
2. Localized Deployment
DongTai IAST supports a of deployment schemes which refer to Deployment Document:
- [x] Docker-compose
- [ ] docker - pending upgrade
- [x] Kubernetes
#### Docker-compose
Contributing
Contributions are welcomed and greatly appreciated. Further reading — CONTRIBUTING.md for details on submitting patches and contribution workflow.
Any questions? Let's discuss in #DongTai discussions
Futher Resources
Stats
!Alt
项目信息
开发语言：Python
Star 数：1311
技术要点
该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Dongtai IAST is an open-source Interactive Application Security Testing (IAST) tool that enables real-time detection of common vulnerabilities in Java applications and third-party components through passive instrumentation. It is particularly suitable for use in the testing phase of the development pipeline.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。
| 资源标题 | DongTai - Dongtai IAST is an open-source Interactive Applica |
| 所属分类 | 漏洞知识库 |
| 发布作者 | admin |
| 发布时间 | 2026-10-06 01:01:38 |
| 下载权限 | 免费下载 |
| 附件数量 | 2 个下载链接 |
| 浏览次数 | 313 |
| 讨论数量 | 0 |
| 主题状态 | 正常讨论中 |