Java Sec Code

Java sec code is a very powerful and friendly project for learning Java vulnerability code.

中文文档 😋Alibaba Security Purple Team Recruitment

Introduce

This project can also be called Java vulnerability code.

Each vulnerability type code has a security vulnerability by default unless there is no vulnerability. The relevant fix code is in the comments or code. Specifically, you can view each vulnerability code and comments.

Due to the server expiration, the online demo site had to go offline.

Login username & password:

admin/admin123
joychou/joychou123

Vulnerability Code

Sort by letter.

Actuators to RCE
CommandInject
CORS
CRLF Injection
CSRF
CVE-2022-22978
Deserialize
Fastjson
File Upload
GetRequestURI
IP Forge
Java RMI
JSONP
Log4j
ooxmlXXE
PathTraversal
RCE
- Runtime
- ProcessBuilder
- ScriptEngine
- Yaml Deserialize
- Groovy
Swagger
SpEL
SQL Injection
SSRF
SSTI
URL Redirect
URL whitelist Bypass
xlsxStreamerXXE
XSS
XStream
XXE
JWT

Vulnerability Description

How to run

The application will use mybatis auto-injection. Please run mysql server ahead of time and configure the mysql server database's name and username/password except docker environment.

spring.datasource.url=jdbc:mysql://127.0.0.1:3306/java_sec_code
spring.datasource.username=root
spring.datasource.password=woshishujukumima

Docker
IDEA
Tomcat
JAR

Docker

Start docker:

docker-compose pull
docker-compose up

Stop docker:

docker-compose down

Docker's environment:

Java 1.8.0_102
Mysql 8.0.17
Tomcat 8.5.11

IDEA

git clone https://github.com/JoyChou93/java-sec-code
Open in IDEA and click run button.

Example:

http://localhost:8080/rce/exec?cmd=whoami

return:

Viarus

Tomcat

git clone https://github.com/JoyChou93/java-sec-code & cd java-sec-code
Build war package by mvn clean package.
Copy war package to tomcat webapps directory.
Start tomcat application.

Example:

http://localhost:8080/java-sec-code-1.0.0/rce/exec?cmd=whoami

return:

Viarus

JAR

Change war to jar in pom.xml.

<groupId>sec</groupId>
<artifactId>java-sec-code</artifactId>
<version>1.0.0</version>
<packaging>war</packaging>

Build package and run.

git clone https://github.com/JoyChou93/java-sec-code
cd java-sec-code
mvn clean package -DskipTests 
java -jar target/java-sec-code-1.0.0.jar

Authenticate

Login

http://localhost:8080/login

If you are not logged in, accessing any page will redirect you to the login page. The username & password are as follows.

admin/admin123
joychou/joychou123

Logout

http://localhost:8080/logout

RememberMe

Tomcat's default JSESSION session is valid for 30 minutes, so a 30-minute non-operational session will expire. In order to solve this problem, the rememberMe function is introduced, and the default expiration time is 2 weeks.

Contributors

Core developers : JoyChou, liergou9981 Other developers: lightless, Anemone95, waderwu.

Donate

If you like the poject, you can donate to support me. With your support, I will be able to make Java sec code better 😎.

Alipay

Scan the QRcode to support Java sec code.

FYYDCC/java-sec-code

ErrorLooks like something went wrong!

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Languages

Error
Looks like something went wrong!

Packages