OWASP Vulnerability Demonstration Project

A comprehensive Spring Boot application demonstrating common OWASP Top 10 vulnerabilities with both vulnerable and secure implementations.

🚀 Quick Start

Prerequisites

• Java 17 or higher (you have Java 26 ✅)
• No Maven installation required (uses Maven Wrapper)

Start the Application

# Vulnerable mode (default)
mvnw.cmd spring-boot:run

# Secure mode
mvnw.cmd spring-boot:run -Dspring-boot.run.profiles=secure

Access URLs:

• Application: http://localhost:8080
• H2 Database Console: http://localhost:8080/h2-console

📊 Database Information

• Type: H2 (file-based)
• Vulnerable DB: ./data/vulnerabledb.mv.db
• Secure DB: ./data/securedb.mv.db
• JDBC URL: jdbc:h2:file:./data/vulnerabledb or jdbc:h2:file:./data/securedb
• Credentials: sa / (empty password)

🧪 Testing Scripts

API Testing

# Run PowerShell test script
.\test-api.ps1

Tests all endpoints and shows confirmation messages for DELETE/POST operations.

Database Reset

When you modify/delete data during testing, reset to initial state:

Option 1: PowerShell Script (Recommended)

.\reset-database.ps1

Option 2: Batch Script

reset-database.bat

What the reset scripts do:

1. Stop any running application
2. Delete database files (.mv.db files)
3. Restart application with fresh data from schema.sql and data.sql

🏗️ Project Structure

owasp-poc/
├── src/main/java/com/poc/owasp/
│   ├── OwaspApplication.java          # Main application
│   ├── config/                        # Security configurations
│   ├── broken_access_control/         # A01 - Access Control
│   ├── cryptographic_failures/        # A02 - Crypto Failures
│   ├── injection/                     # A03 - Injection
│   ├── mishandling_of_exceptional_conditions/  # Exception Handling
│   └── security_misconfiguration/     # A05 - Security Misconfig
├── src/main/resources/
│   ├── application.yml                # Default config
│   ├── application-vulnerable.yml     # Vulnerable profile
│   ├── application-secure.yml         # Secure profile
│   ├── schema.sql                     # Database schema
│   └── data.sql                       # Initial data
├── api-collection.yaml                # Postman collection
├── start-commands.txt                 # Quick reference
├── test-api.ps1                       # API testing script
├── reset-database.ps1                 # Database reset (PowerShell)
└── reset-database.bat                 # Database reset (Batch)

🎯 Available Endpoints

Vulnerable Endpoints (Port 8080)

• GET /injection/search?category=books - SQL Injection demo
• POST /orders/{id} - Delete via wrong HTTP method
• DELETE /orders/admin/purge - Admin operation without auth
• POST /crypto/login - Weak crypto login
• GET /exception/orders/{id}/debug - Information disclosure

Secure Endpoints (Port 8080)

• GET /secure/injection/search?category=books - Safe parameterized queries
• DELETE /secure/orders/{id} - Proper authorization
• DELETE /secure/orders/admin/purge - Role-based admin access
• POST /secure/crypto/login - Strong crypto implementation
• GET /secure/exception/orders/{id}/debug - Safe error handling

🔒 Authentication

Some endpoints require Basic Authentication:

• User: user:password
• Admin: admin:password

Base64 encoded:

• User: dXNlcjpwYXNzd29yZA==
• Admin: YWRtaW46cGFzc3dvcmQ=

📚 Learning Objectives

This project demonstrates:

• A01 - Broken Access Control - Authorization bypasses
• A02 - Cryptographic Failures - Weak encryption
• A03 - Injection - SQL injection vulnerabilities
• A05 - Security Misconfiguration - Improper configurations
• Exception Handling - Information leakage through errors

Each vulnerability includes both vulnerable and secure implementations for comparison.

🛠️ Development

Build the Application

mvnw.cmd clean package
java -jar target/owasp-0.0.1-SNAPSHOT.jar

Import API Collection

Import api-collection.yaml into Postman/Insomnia for comprehensive API testing.

🤝 Contributing

This is an educational project. Feel free to:

• Add new vulnerability demonstrations
• Improve secure implementations
• Enhance testing scripts
• Update documentation

⚠️ Disclaimer

This application intentionally contains security vulnerabilities for educational purposes only. Never deploy this code in production or expose it to untrusted networks.

---

Happy Hacking! 🔐