diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 00000000..196def68 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,3 @@ +mysql-data/ +.git/ +target/ diff --git a/.gitignore b/.gitignore new file mode 100644 index 00000000..5fbd561e --- /dev/null +++ b/.gitignore @@ -0,0 +1,8 @@ +mysql-data/ +target/ +*.war +*.class +.idea/ +*.iml +.vscode/ +.DS_Store diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 00000000..a73d7d18 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,31 @@ +# Stage 1: Build Stage +FROM eclipse-temurin:8-jdk AS build + +WORKDIR /app + +# Copy the source code into the Docker image +COPY . . + +# Install Maven and JDK, then build the project +RUN apt-get update && \ + apt-get install -y maven && \ + mvn clean package && \ + mvn dependency:copy-dependencies -DincludeArtifactIds=mysql-connector-java -DoutputDirectory=/app/shared-libs + +# Stage 2: Runtime Stage +FROM tomcat:7.0.82 + +# Copy the WAR file built in the previous stage +COPY --from=build /app/target/*.war /usr/local/tomcat/webapps/ + +# Copy the JDBC driver into Tomcat's shared lib so the pool DataSource (declared +# in META-INF/context.xml and loaded by the container classloader) can find it. +COPY --from=build /app/shared-libs/*.jar /usr/local/tomcat/lib/ + +# Copy the pre-prepared tomcat-users.xml to set up user roles +COPY default-tomcat.xml /usr/local/tomcat/conf/tomcat-users.xml + +ENV CATALINA_OPTS="-Xms256m -Xmx1024m" + +# CMD to start Tomcat +CMD ["catalina.sh", "run"] diff --git a/LICENSE b/LICENSE index 23cb7903..d6a93266 100644 --- a/LICENSE +++ b/LICENSE @@ -1,4 +1,4 @@ - GNU GENERAL PUBLIC LICENSE +GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., @@ -337,3 +337,4 @@ proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. + diff --git a/README.md b/README.md index 8560b23a..5e12e78a 100644 --- a/README.md +++ b/README.md @@ -1,15 +1,132 @@ -This is Vulnerable Web Application developed for course by Cyber Security and Privacy Foundation -(www.cysecurity.org) for Java programmers +Java Vulnerable Lab +=================== -Get the VulnerableSpring Project from here: -https://github.com/breakthesec/VulnerableSpring +A deliberately vulnerable Java web application from the [Cyber Security and Privacy Foundation](https://www.cysecurity.org). It is built for Java developers and anyone else who wants to find real web application vulnerabilities, exploit them, and then read the source to understand why they were possible and how to fix them. ----------------------------------- -The full course on Hacking and Securing Web Java Programs is available in ------------------------------------ -https://www.udemy.com/hacking-securing-java-web-programming/ +Every challenge is mapped to a category from the [OWASP Top 10:2025](https://owasp.org/Top10/2025/), and each vulnerable page carries a comment explaining the flaw and the fix. ----------------------------------- -VirtualBox VM can be found here: ----------------------------------- -http://sourceforge.net/projects/javavulnerablelab/files/v0.1/JavaVulnerableLab.ova/download +**Warning:** this application is intentionally insecure. Several challenges give remote code execution inside the container. Running it locally with Docker on your own machine is fine. Do not expose it to the internet and never deploy it on a public facing or production server. + +One thing to be aware of: Docker publishes port 9080 on all interfaces, so anyone on the same network can reach the lab. If you are on shared or untrusted wifi, change the port mapping in `docker-compose.yml` to `127.0.0.1:9080:8080` to keep it on your machine only. + +Quick start (Docker) +-------------------- + +This is the supported setup and the one that matches the current code. + + 1. Install Docker and Docker Compose: https://docs.docker.com/engine/install/ + 2. From this directory, run: docker compose up --build + 3. Wait for Tomcat to finish starting. + 4. Open http://localhost:9080/JavaVulnerableLab/install.jsp + 5. Click Install. The defaults are already correct for the Compose setup. + 6. Open http://localhost:9080/JavaVulnerableLab/ and start with the Vulnerability menu. + +The app is published on port **9080** so it does not collide with anything else you may already have on 8080. Inside the container Tomcat still listens on 8080, which matters for a couple of the challenges. + +MySQL data persists in `./mysql-data`. To start over from a clean database, stop the stack, delete that directory, and re-run the install step. + +Default logins +-------------- + +Created by `install.jsp`. All passwords are stored in plaintext, which is one of the lessons. + +| Username | Password | Role | +| --------- | -------- | ----- | +| admin | admin | admin | +| victim | victim | user | +| attacker | attacker | user | +| NEO | trinity | user | +| trinity | NEO | user | +| Anderson | java | user | +| mule | mule | user | + +The admin username and password are whatever you typed on the install page, and default to `admin` / `admin`. + +What is inside +-------------- + +Challenges are reachable from the **Vulnerability** menu in the top navigation, grouped by OWASP Top 10:2025 category. + +**A01 Broken Access Control** +Insecure direct object references (viewing and modifying another user's profile), path traversal in the document download, missing function level access control on the admin pages, privilege escalation by tampering with an unverified JWT claim, privilege escalation via a trusted cookie, CSRF over both GET and POST, server-side request forgery, and open redirect and forward. + +**A02 Security Misconfiguration** +The setup page left deployed, unchanged default admin credentials, directory listing enabled on `/backup/`, debug mode left on in production, and XML external entity processing. + +**A03 Software Supply Chain Failures** +Log4Shell (CVE-2021-44228) through a bundled Log4j 2.12.1, plus a companion Spring application in [VulnerableSpring](https://github.com/CSPF-Founder/VulnerableSpring). + +**A04 Cryptographic Failures** +Card data sent in cleartext, passwords stored in plaintext, credentials written to a cookie, and MD5 password hashing. + +**A05 Injection** +SQL injection (error based, blind, union, and authentication bypass), OS command injection, XPath injection, XSLT injection, ORM injection, and reflected, stored and Flash-based cross-site scripting. + +**A06 Insecure Design** +Account recovery through a guessable security question, unrestricted file upload leading to a web shell, and an OTP step-up flow whose result is decided by the client. + +**A07 Authentication Failures** +Login with no rate limiting or lockout, username enumeration, password change without reauthentication, session fixation via URL rewriting, and backend API keys hard-coded into front-end JavaScript. + +**A08 Software or Data Integrity Failures** +Insecure Java deserialization of a client-supplied view state, reachable with a ysoserial CommonsCollections gadget, and a third-party script loaded with no Subresource Integrity. + +**A09 Security Logging and Alerting Failures** +Log injection that forges audit trail entries and attributes an action to another user. + +**A10 Mishandling of Exceptional Conditions** +An unhandled exception leaking a stack trace, an access check that fails open when its input is missing, and a wallet transfer with no rollback that corrupts balances. + +Other installation methods +-------------------------- + +**These are not maintained and predate the OWASP Top 10:2025 rewrite.** The prebuilt VM image, the standalone JAR and the released WAR on SourceForge are all older than the current code and will not contain the newer challenges. Use Docker unless you have a specific reason not to. They are kept here for reference. + +
+VirtualBox VM (outdated) + + 1. Install VirtualBox: https://www.virtualbox.org/wiki/Downloads + 2. Download the VM image: http://sourceforge.net/projects/javavulnerablelab/files/v0.1/JavaVulnerableLab.ova/download + 3. Import JavaVulnerableLab.ova into VirtualBox. + 4. Set the network to Host-Only. + 5. Start the machine and log in (username: root, password: cspf). + 6. Run "service tomcat start" and "service mysql start". + 7. Find the IP address of the machine. + 8. Open http://[VM_IP]:8080/JavaVulnerableLab/install.jsp and click Install. + +
+ +
+Standalone JAR with embedded Tomcat (outdated) + + 1. Install a JDK. + 2. Download: http://sourceforge.net/projects/javavulnerablelab/files/v0.2/JavaVulnerableLab.jar/download + 3. Run: java -jar JavaVulnerableLab.jar + 4. Open http://localhost:8080/JavaVulnerableLab/install.jsp and click Install. + +
+ +
+WAR file on your own Tomcat (outdated) + + 1. Install Apache Tomcat. + 2. Go to http://[TOMCAT_IP]:8080/manager/ (edit tomcat-users.xml to allow manager access first). + 3. Download: https://sourceforge.net/projects/javavulnerablelab/files/latest/JavaVulnerableLab.war/download + 4. Deploy the WAR through the manager. + 5. Open http://[TOMCAT_IP]:8080/JavaVulnerableLab/install.jsp and click Install. + +
+ +To build a current WAR from source instead, run `mvn clean package` and deploy `target/JavaVulnerableLab.war`. It needs a MySQL database and a JDK 8 build environment. + +Learning material +----------------- + +The full course content is on GitHub for free: https://github.com/CSPF-Founder/JavaSecurityCourse + +The full course on hacking and securing Java web programs: https://learn.cysecurity.org/course/view.php?id=3 + +License +------- + +GNU General Public License v2. See [LICENSE](LICENSE). diff --git a/build.xml b/build.xml deleted file mode 100644 index 841659cb..00000000 --- a/build.xml +++ /dev/null @@ -1,71 +0,0 @@ - - - - - - - - - - - Builds, tests, and runs the project JavaVulnerableLab. - - - diff --git a/default-tomcat.xml b/default-tomcat.xml new file mode 100644 index 00000000..a225d5e4 --- /dev/null +++ b/default-tomcat.xml @@ -0,0 +1,6 @@ + + + + + + diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 00000000..fb13ef9c --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,25 @@ + +services: + jvl: + image: cspf/jvl + build: + dockerfile: ./Dockerfile + context: ./ + ports: + - 9080:8080 + links: + - mysql + + mysql: + image: mysql:5.7 + environment: + MYSQL_ROOT_PASSWORD: root + MYSQL_ROOT_HOST: "%" + MYSQL_DATABASE: abc + command: + - "--default-authentication-plugin=mysql_native_password" + - "--max_connections=500" + - "--wait_timeout=120" + - "--interactive_timeout=120" + volumes: + - ./mysql-data:/var/lib/mysql diff --git a/nbproject/ant-deploy.xml b/nbproject/ant-deploy.xml deleted file mode 100644 index 5ca2a427..00000000 --- a/nbproject/ant-deploy.xml +++ /dev/null @@ -1,37 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/nbproject/build-impl.xml b/nbproject/build-impl.xml deleted file mode 100644 index df502d08..00000000 --- a/nbproject/build-impl.xml +++ /dev/null @@ -1,1448 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must set src.dir - Must set test.src.dir - Must set build.dir - Must set build.web.dir - Must set build.generated.dir - Must set dist.dir - Must set build.classes.dir - Must set dist.javadoc.dir - Must set build.test.classes.dir - Must set build.test.results.dir - Must set build.classes.excludes - Must set dist.war - - - - - - - - - -The Java EE server classpath is not correctly set up - server home directory is missing. -Either open the project in the IDE and assign the server or setup the server classpath manually. -For example like this: - ant -Dj2ee.server.home=<app_server_installation_directory> - - -The Java EE server classpath is not correctly set up. Your active server type is ${j2ee.server.type}. -Either open the project in the IDE and assign the server or setup the server classpath manually. -For example like this: - ant -Duser.properties.file=<path_to_property_file> (where you put the property "j2ee.platform.classpath" in a .properties file) -or ant -Dj2ee.platform.classpath=<server_classpath> (where no properties file is used) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must set javac.includes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - No tests executed. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -The libs.CopyLibs.classpath property is not set up. -This property must point to -org-netbeans-modules-java-j2seproject-copylibstask.jar file which is part -of NetBeans IDE installation and is usually located at -<netbeans_installation>/java<version>/ant/extra folder. -Either open the project in the IDE and make sure CopyLibs library -exists or setup the property manually. For example like this: - ant -Dlibs.CopyLibs.classpath=a/path/to/org-netbeans-modules-java-j2seproject-copylibstask.jar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must set JVM to use for profiling in profiler.info.jvm - Must set profiler agent JVM arguments in profiler.info.jvmargs.agent - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must select some files in the IDE or set javac.includes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must select some files in the IDE or set javac.jsp.includes - - - - - - - - - - - - - - - - - - - - - - - - - - Must select a file in the IDE or set jsp.includes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Browser not found, cannot launch the deployed application. Try to set the BROWSER environment variable. - - - Launching ${browse.url} - - - - - - Must select one file in the IDE or set run.class - - - - Must select one file in the IDE or set run.class - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must select one file in the IDE or set debug.class - - - - - - - - - - - - Must select one file in the IDE or set debug.class - - - - - Must set fix.includes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - This target only works when run from inside the NetBeans IDE. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must select some files in the IDE or set javac.includes - - - - - - - - - - - - - - - - - - - Some tests failed; see details above. - - - - - - - - - Must select some files in the IDE or set test.includes - - - - Some tests failed; see details above. - - - - Must select some files in the IDE or set test.class - Must select some method in the IDE or set test.method - - - - Some tests failed; see details above. - - - - - Must select one file in the IDE or set test.class - - - - Must select one file in the IDE or set test.class - Must select some method in the IDE or set test.method - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/nbproject/genfiles.properties b/nbproject/genfiles.properties deleted file mode 100644 index cb66364d..00000000 --- a/nbproject/genfiles.properties +++ /dev/null @@ -1,8 +0,0 @@ -build.xml.data.CRC32=903755fa -build.xml.script.CRC32=8f523743 -build.xml.stylesheet.CRC32=651128d4@1.67.1.1 -# This file is used by a NetBeans-based IDE to track changes in generated files such as build-impl.xml. -# Do not edit this file. You may delete it but then the IDE will never regenerate such files for you. -nbproject/build-impl.xml.data.CRC32=903755fa -nbproject/build-impl.xml.script.CRC32=084958d7 -nbproject/build-impl.xml.stylesheet.CRC32=99ea4b56@1.67.1.1 diff --git a/nbproject/private/private.properties b/nbproject/private/private.properties deleted file mode 100644 index a50452d9..00000000 --- a/nbproject/private/private.properties +++ /dev/null @@ -1,8 +0,0 @@ -deploy.ant.properties.file=/home/breakthesec/.netbeans/8.0/tomcat80.properties -j2ee.server.domain=/home/breakthesec/.netbeans/8.0/apache-tomcat-8.0.3.0_base -j2ee.server.home=/home/breakthesec/apache-tomcat-8.0.3 -j2ee.server.instance=tomcat80:home=/home/breakthesec/apache-tomcat-8.0.3:base=apache-tomcat-8.0.3.0_base -javac.debug=true -javadoc.preview=true -selected.browser=default -user.properties.file=/home/breakthesec/.netbeans/8.0/build.properties diff --git a/nbproject/private/private.xml b/nbproject/private/private.xml deleted file mode 100644 index 6807a2ba..00000000 --- a/nbproject/private/private.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - - - - diff --git a/nbproject/project.properties b/nbproject/project.properties deleted file mode 100644 index 6ea3de55..00000000 --- a/nbproject/project.properties +++ /dev/null @@ -1,88 +0,0 @@ -annotation.processing.enabled=true -annotation.processing.enabled.in.editor=true -annotation.processing.processors.list= -annotation.processing.run.all.processors=true -annotation.processing.source.output=${build.generated.sources.dir}/ap-source-output -build.classes.dir=${build.web.dir}/WEB-INF/classes -build.classes.excludes=**/*.java,**/*.form -build.dir=build -build.generated.dir=${build.dir}/generated -build.generated.sources.dir=${build.dir}/generated-sources -build.test.classes.dir=${build.dir}/test/classes -build.test.results.dir=${build.dir}/test/results -build.web.dir=${build.dir}/web -build.web.excludes=${build.classes.excludes} -client.urlPart= -compile.jsps=false -conf.dir=${source.root}/conf -debug.classpath=${build.classes.dir}:${javac.classpath} -debug.test.classpath=\ - ${run.test.classpath} -display.browser=true -# Files to be excluded from distribution war -dist.archive.excludes= -dist.dir=dist -dist.ear.war=${dist.dir}/${war.ear.name} -dist.javadoc.dir=${dist.dir}/javadoc -dist.war=${dist.dir}/${war.name} -endorsed.classpath=\ - ${libs.javaee-endorsed-api-6.0.classpath} -excludes= -file.reference.json-20090211.jar=/media/breakthesec/Extra/GuestFolder/jar libs/json-20090211.jar -file.reference.mysql-connector-java-5.1.33-bin.jar=../mysql-connector-java-5.1.33-bin.jar -includes=** -j2ee.compile.on.save=true -j2ee.copy.static.files.on.save=true -j2ee.deploy.on.save=true -j2ee.platform=1.7-web -j2ee.platform.classpath=${j2ee.server.home}/lib/annotations-api.jar:${j2ee.server.home}/lib/catalina-ant.jar:${j2ee.server.home}/lib/catalina-ha.jar:${j2ee.server.home}/lib/catalina-storeconfig.jar:${j2ee.server.home}/lib/catalina-tribes.jar:${j2ee.server.home}/lib/catalina.jar:${j2ee.server.home}/lib/ecj-4.3.1.jar:${j2ee.server.home}/lib/el-api.jar:${j2ee.server.home}/lib/jasper-el.jar:${j2ee.server.home}/lib/jasper.jar:${j2ee.server.home}/lib/jsp-api.jar:${j2ee.server.home}/lib/servlet-api.jar:${j2ee.server.home}/lib/tomcat-api.jar:${j2ee.server.home}/lib/tomcat-coyote.jar:${j2ee.server.home}/lib/tomcat-dbcp.jar:${j2ee.server.home}/lib/tomcat-i18n-es.jar:${j2ee.server.home}/lib/tomcat-i18n-fr.jar:${j2ee.server.home}/lib/tomcat-i18n-ja.jar:${j2ee.server.home}/lib/tomcat-jdbc.jar:${j2ee.server.home}/lib/tomcat-jni.jar:${j2ee.server.home}/lib/tomcat-spdy.jar:${j2ee.server.home}/lib/tomcat-util-scan.jar:${j2ee.server.home}/lib/tomcat-util.jar:${j2ee.server.home}/lib/tomcat-websocket.jar:${j2ee.server.home}/lib/websocket-api.jar -j2ee.server.type=Tomcat -jar.compress=false -javac.classpath=\ - ${file.reference.mysql-connector-java-5.1.33-bin.jar}:\ - ${file.reference.json-20090211.jar}:\ - ${libs.jstl.classpath} -# Space-separated list of extra javac options -javac.compilerargs= -javac.debug=true -javac.deprecation=false -javac.processorpath=\ - ${javac.classpath} -javac.source=1.6 -javac.target=1.6 -javac.test.classpath=\ - ${javac.classpath}:\ - ${build.classes.dir} -javac.test.processorpath=\ - ${javac.test.classpath} -javadoc.additionalparam= -javadoc.author=false -javadoc.encoding=${source.encoding} -javadoc.noindex=false -javadoc.nonavbar=false -javadoc.notree=false -javadoc.preview=true -javadoc.private=false -javadoc.splitindex=true -javadoc.use=true -javadoc.version=false -javadoc.windowtitle= -lib.dir=${web.docbase.dir}/WEB-INF/lib -persistence.xml.dir=${conf.dir} -platform.active=default_platform -resource.dir=setup -run.test.classpath=\ - ${javac.test.classpath}:\ - ${build.test.classes.dir} -# Space-separated list of JVM arguments used when running a class with a main method or a unit test -# (you may also define separate properties like run-sys-prop.name=value instead of -Dname=value): -runmain.jvmargs= -source.encoding=UTF-8 -source.root=src -src.dir=${source.root}/java -test.src.dir=test -war.content.additional= -war.ear.name=${war.name} -war.name=JavaVulnerableLab.war -web.docbase.dir=web -webinf.dir=web/WEB-INF diff --git a/nbproject/project.xml b/nbproject/project.xml deleted file mode 100644 index fe0dff12..00000000 --- a/nbproject/project.xml +++ /dev/null @@ -1,31 +0,0 @@ - - - org.netbeans.modules.web.project - - - JavaVulnerableLab - 1.6.5 - - - ${file.reference.mysql-connector-java-5.1.33-bin.jar} - WEB-INF/lib - - - ${file.reference.json-20090211.jar} - WEB-INF/lib - - - ${libs.jstl.classpath} - WEB-INF/lib - - - - - - - - - - - - diff --git a/pom.xml b/pom.xml new file mode 100644 index 00000000..03b763ee --- /dev/null +++ b/pom.xml @@ -0,0 +1,85 @@ + + 4.0.0 + org.cysecurity + JavaVulnerableLab + war + 0.0.1-SNAPSHOT + JavaVulnerableLab Maven Webapp + http://maven.apache.org + + + junit + junit + 3.8.1 + test + + + mysql + mysql-connector-java + 5.1.26 + + + org.json + json + 20090211 + + + javax.servlet + jstl + 1.2 + + + org.hibernate + hibernate-core + 4.0.1.Final + + + javax.servlet + servlet-api + 2.3 + provided + + + + org.apache.logging.log4j + log4j-api + 2.12.1 + + + org.apache.logging.log4j + log4j-core + 2.12.1 + + + + commons-collections + commons-collections + 3.1 + + + + commons-fileupload + commons-fileupload + 1.3.3 + + + commons-io + commons-io + 2.6 + + + + JavaVulnerableLab + + + 1.7 + 1.7 + + diff --git a/src/conf/MANIFEST.MF b/src/conf/MANIFEST.MF deleted file mode 100644 index 59499bce..00000000 --- a/src/conf/MANIFEST.MF +++ /dev/null @@ -1,2 +0,0 @@ -Manifest-Version: 1.0 - diff --git a/src/java/model/DBConnect.java b/src/java/model/DBConnect.java deleted file mode 100644 index 9dd95fdc..00000000 --- a/src/java/model/DBConnect.java +++ /dev/null @@ -1,43 +0,0 @@ -/* - * To change this license header, choose License Headers in Project Properties. - * To change this template file, choose Tools | Templates - * and open the template in the editor. - */ - -package model; - - -import java.io.FileInputStream; -import java.io.IOException; -import java.io.InputStream; -import java.sql.Connection; -import java.sql.DriverManager; -import java.sql.SQLException; -import java.util.Properties; - -/** - * - * @author breakthesec - */ -public class DBConnect { - public Connection connect(String path) throws IOException,ClassNotFoundException,SQLException - { - Properties properties=new Properties(); - properties.load(new FileInputStream(path)); - String dbuser=properties.getProperty("dbuser"); - String dbpass = properties.getProperty("dbpass"); - String dbfullurl = properties.getProperty("dburl")+properties.getProperty("dbname"); - String jdbcdriver = properties.getProperty("jdbcdriver"); - Connection con=null; - try - { - Class.forName(jdbcdriver); - con= DriverManager.getConnection(dbfullurl,dbuser,dbpass); - return con; - } - finally - { - - } - } -} diff --git a/src/java/controller/AddPage.java b/src/main/java/org/cysecurity/cspf/jvl/controller/AddPage.java similarity index 98% rename from src/java/controller/AddPage.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/AddPage.java index 0b8da423..343701b3 100644 --- a/src/java/controller/AddPage.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/AddPage.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.BufferedWriter; import java.io.File; diff --git a/src/main/java/org/cysecurity/cspf/jvl/controller/AvatarUpload.java b/src/main/java/org/cysecurity/cspf/jvl/controller/AvatarUpload.java new file mode 100644 index 00000000..2e9e2365 --- /dev/null +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/AvatarUpload.java @@ -0,0 +1,59 @@ +package org.cysecurity.cspf.jvl.controller; + +import java.io.File; +import java.io.IOException; +import java.util.List; +import javax.servlet.ServletException; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpSession; +import org.apache.commons.fileupload.FileItem; +import org.apache.commons.fileupload.disk.DiskFileItemFactory; +import org.apache.commons.fileupload.servlet.ServletFileUpload; + +/** + * A06 Insecure Design (CWE-434): a "profile picture" upload whose design never + * restricts the file type, size, or destination. Any file, including an + * executable JSP, is written under the web root with its original name, so it + * can be requested and run as a web shell. + */ +public class AvatarUpload extends HttpServlet { + + protected void doPost(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + HttpSession session = request.getSession(false); + if (session == null || session.getAttribute("isLoggedIn") == null) { + response.sendRedirect("login.jsp"); + return; + } + + String uploadDir = getServletContext().getRealPath("/uploads"); + new File(uploadDir).mkdirs(); + + String message = "No file received."; + try { + ServletFileUpload upload = new ServletFileUpload(new DiskFileItemFactory()); + List items = upload.parseRequest(request); + for (FileItem item : items) { + if (!item.isFormField() && item.getName() != null && !item.getName().isEmpty()) { + // VULNERABLE BY DESIGN: the client filename and extension are + // trusted as-is. No type / extension / content validation. + String fileName = new File(item.getName()).getName(); + File stored = new File(uploadDir, fileName); + item.write(stored); + message = "Uploaded to " + request.getContextPath() + "/uploads/" + fileName; + } + } + } catch (Exception e) { + message = "Upload failed: " + e.getMessage(); + } + request.setAttribute("uploadMessage", message); + request.getRequestDispatcher("/vulnerability/upload/avatar.jsp").forward(request, response); + } + + protected void doGet(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + request.getRequestDispatcher("/vulnerability/upload/avatar.jsp").forward(request, response); + } +} diff --git a/src/java/controller/EmailCheck.java b/src/main/java/org/cysecurity/cspf/jvl/controller/EmailCheck.java similarity index 97% rename from src/java/controller/EmailCheck.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/EmailCheck.java index cbcf1c5f..c5edb24d 100644 --- a/src/java/controller/EmailCheck.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/EmailCheck.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -15,7 +15,7 @@ import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; import org.json.JSONObject; /** @@ -89,7 +89,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ - @Override + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { processRequest(request, response); diff --git a/src/java/controller/ForwardMe.java b/src/main/java/org/cysecurity/cspf/jvl/controller/ForwardMe.java similarity index 98% rename from src/java/controller/ForwardMe.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/ForwardMe.java index 56cca1c5..72ee696c 100644 --- a/src/java/controller/ForwardMe.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/ForwardMe.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; diff --git a/src/java/controller/install.java b/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java similarity index 96% rename from src/java/controller/install.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/Install.java index ad6b9cc6..249eee35 100644 --- a/src/java/controller/install.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java @@ -1,4 +1,4 @@ - package controller; + package org.cysecurity.cspf.jvl.controller; /* * To change this license header, choose License Headers in Project Properties. @@ -10,7 +10,6 @@ import java.io.FileOutputStream; import java.io.IOException; import java.io.PrintWriter; -import java.security.NoSuchAlgorithmException; import java.sql.Connection; import java.sql.DriverManager; import java.sql.SQLException; @@ -20,13 +19,13 @@ import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import model.HashMe; +import org.cysecurity.cspf.jvl.model.HashMe; /** * * @author breakthesec */ -public class install extends HttpServlet { +public class Install extends HttpServlet { static String dburl; static String jdbcdriver; @@ -124,13 +123,14 @@ protected boolean setup(String i) throws IOException if(!con.isClosed()) { //User Table creation - stmt.executeUpdate("Create table users(ID int NOT NULL AUTO_INCREMENT, username varchar(30),email varchar(60), password varchar(60), about varchar(50),privilege varchar(20),avatar TEXT,secretquestion int,secret varchar(30),primary key (id))"); + stmt.executeUpdate("Create table users(ID int NOT NULL AUTO_INCREMENT, username varchar(30),email varchar(60), password varchar(60), about varchar(50),privilege varchar(20),avatar TEXT,secretquestion int,secret varchar(30),balance int NOT NULL DEFAULT 1000,primary key (id))"); stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('"+adminuser+"','"+adminpass+"','admin@localhost','I am the admin of this application','default.jpg','admin',1,'rocky')"); stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('victim','victim','victim@localhost','I am the victim of this application','default.jpg','user',1,'max')"); stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('attacker','attacker','attacker@localhost','I am the attacker of this application','default.jpg','user',1,'bella')"); stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('NEO','trinity','neo@matrix','I am the NEO','default.jpg','user',1,'sentinel')"); stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('trinity','NEO','trinity@matrix','it is Trinity','default.jpg','user',1,'sentinel')"); stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('Anderson','java','anderson@1999','I am computer programmer','default.jpg','user',1,'C++')"); + stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('mule','mule','mule@burner','A burner account','default.jpg','user',1,'x')"); //Posts table creation stmt.executeUpdate("create table posts(postid int NOT NULL AUTO_INCREMENT, content TEXT,title varchar(100), user varchar(30), primary key (postid))"); @@ -224,4 +224,4 @@ public String getServletInfo() { return "Short description"; }// -} +} \ No newline at end of file diff --git a/src/java/controller/LoginValidator.java b/src/main/java/org/cysecurity/cspf/jvl/controller/LoginValidator.java similarity index 92% rename from src/java/controller/LoginValidator.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/LoginValidator.java index 81993bd9..5919cb22 100644 --- a/src/java/controller/LoginValidator.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/LoginValidator.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -17,7 +17,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; @@ -58,6 +58,9 @@ protected void processRequest(HttpServletRequest request, HttpServletResponse re session.setAttribute("avatar", rs.getString("avatar")); Cookie privilege=new Cookie("privilege","user"); response.addCookie(privilege); + Cookie jwt=new Cookie("jwt",org.cysecurity.cspf.jvl.model.JwtUtil.sign(rs.getString("username"), rs.getString("privilege"))); + jwt.setPath(request.getContextPath()); + response.addCookie(jwt); if(request.getParameter("RememberMe")!=null) { Cookie username=new Cookie("username",user); diff --git a/src/java/controller/Logout.java b/src/main/java/org/cysecurity/cspf/jvl/controller/Logout.java similarity index 98% rename from src/java/controller/Logout.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/Logout.java index 7bd07bef..986de9b3 100644 --- a/src/java/controller/Logout.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/Logout.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; diff --git a/src/java/controller/open.java b/src/main/java/org/cysecurity/cspf/jvl/controller/Open.java similarity index 96% rename from src/java/controller/open.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/Open.java index b45ff108..9cf1a268 100644 --- a/src/java/controller/open.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/Open.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -17,7 +17,7 @@ * * @author breakthesec */ -public class open extends HttpServlet { +public class Open extends HttpServlet { /** * Processes requests for both HTTP GET and POST diff --git a/src/java/controller/Register.java b/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java similarity index 97% rename from src/java/controller/Register.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/Register.java index 4b679e3c..afa2f835 100644 --- a/src/java/controller/Register.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -17,7 +17,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; /** * diff --git a/src/java/controller/SendMessage.java b/src/main/java/org/cysecurity/cspf/jvl/controller/SendMessage.java similarity index 97% rename from src/java/controller/SendMessage.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/SendMessage.java index 11bfe52d..73fa79aa 100644 --- a/src/java/controller/SendMessage.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/SendMessage.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -14,7 +14,7 @@ import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; /** * diff --git a/src/main/java/org/cysecurity/cspf/jvl/controller/Transfer.java b/src/main/java/org/cysecurity/cspf/jvl/controller/Transfer.java new file mode 100644 index 00000000..758201f6 --- /dev/null +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/Transfer.java @@ -0,0 +1,89 @@ +package org.cysecurity.cspf.jvl.controller; + +import java.io.IOException; +import java.sql.Connection; +import java.sql.PreparedStatement; +import javax.servlet.ServletException; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpSession; +import org.cysecurity.cspf.jvl.model.DBConnect; + +/** + * Wallet transfer between accounts. + * + * VULNERABLE (A10 Mishandling of Exceptional Conditions - CWE-460, CWE-703): + * the recipient is credited first, then the sender is debited to settle, with no + * transaction and no rollback. When settlement fails (insufficient funds), the code + * throws to abort, but the already-committed credit is never rolled back, so money is + * created out of nothing and the ledger is left in a corrupt, inconsistent state. + */ +public class Transfer extends HttpServlet { + + protected void processRequest(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + response.setContentType("text/html;charset=UTF-8"); + String ctx = request.getContextPath(); + try { + HttpSession session = request.getSession(); + String from = (String) session.getAttribute("user"); + String to = request.getParameter("to"); + String amountStr = request.getParameter("amount"); + + if (from == null || to == null || amountStr == null || request.getParameter("send") == null) { + response.sendRedirect(ctx + "/vulnerability/transfer/index.jsp"); + return; + } + + int amount = Integer.parseInt(amountStr); + Connection con = new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties")); + if (con != null && !con.isClosed()) { + // The recipient is credited instantly, then the transfer is "settled" by + // debiting the sender. There is NO transaction wrapping the two steps and + // NO rollback, so a failed settlement leaves the credit standing. + + // Step 1: credit the recipient -- commits immediately (auto-commit is on) + PreparedStatement credit = con.prepareStatement( + "UPDATE users SET balance = balance + ? WHERE username = ?"); + credit.setInt(1, amount); + credit.setString(2, to); + credit.executeUpdate(); + + // Step 2: settle by debiting the sender, only if the funds are there + PreparedStatement debit = con.prepareStatement( + "UPDATE users SET balance = balance - ? WHERE username = ? AND balance >= ?"); + debit.setInt(1, amount); + debit.setString(2, from); + debit.setInt(3, amount); + if (debit.executeUpdate() != 1) { + // Settlement failed (insufficient funds). The code detects it and aborts, + // but the credit in Step 1 already committed and is never rolled back. + throw new IllegalStateException("settlement failed: insufficient funds"); + } + + con.close(); + } + response.sendRedirect(ctx + "/vulnerability/transfer/index.jsp"); + } catch (Exception ex) { + response.sendRedirect(ctx + "/vulnerability/transfer/index.jsp"); + } + } + + @Override + protected void doGet(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + processRequest(request, response); + } + + @Override + protected void doPost(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + processRequest(request, response); + } + + @Override + public String getServletInfo() { + return "Wallet transfer (A10 incomplete-rollback demo)"; + } +} diff --git a/src/java/controller/UsernameCheck.java b/src/main/java/org/cysecurity/cspf/jvl/controller/UsernameCheck.java similarity index 97% rename from src/java/controller/UsernameCheck.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/UsernameCheck.java index 231f1a81..f24eccdc 100644 --- a/src/java/controller/UsernameCheck.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/UsernameCheck.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -15,7 +15,7 @@ import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; import org.json.JSONObject; /** diff --git a/src/java/controller/XPathQuery.java b/src/main/java/org/cysecurity/cspf/jvl/controller/XPathQuery.java similarity index 98% rename from src/java/controller/XPathQuery.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/XPathQuery.java index 0a0bb606..a50856a3 100644 --- a/src/java/controller/XPathQuery.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/XPathQuery.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; diff --git a/src/java/controller/xxe.java b/src/main/java/org/cysecurity/cspf/jvl/controller/xxe.java similarity index 95% rename from src/java/controller/xxe.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/xxe.java index 9e0d61c7..f8718662 100644 --- a/src/java/controller/xxe.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/xxe.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.InputStream; @@ -44,14 +44,14 @@ protected void processRequest(HttpServletRequest request, HttpServletResponse re InputStream xml=request.getInputStream(); DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); DocumentBuilder builder = factory.newDocumentBuilder(); - InputSource is = new InputSource(xml); + InputSource is = new InputSource(xml); Document doc = builder.parse(is); Element element = doc.getDocumentElement(); NodeList nodes = element.getChildNodes(); out.print("
Result:
"); out.print("---------------------
"); for (int i = 0; i < nodes.getLength(); i++) { - out.print(nodes.item(i).getNodeName()+" : " + nodes.item(i).getTextContent()); + out.print(nodes.item(i).getNodeName()+" : " + nodes.item(i).getFirstChild().getNodeValue().toString()); out.print("
"); } } diff --git a/src/main/java/org/cysecurity/cspf/jvl/model/DBConnect.java b/src/main/java/org/cysecurity/cspf/jvl/model/DBConnect.java new file mode 100644 index 00000000..80c4229b --- /dev/null +++ b/src/main/java/org/cysecurity/cspf/jvl/model/DBConnect.java @@ -0,0 +1,59 @@ +package org.cysecurity.cspf.jvl.model; + +import java.io.FileInputStream; +import java.io.IOException; +import java.sql.Connection; +import java.sql.DriverManager; +import java.sql.SQLException; +import java.util.Properties; +import javax.naming.Context; +import javax.naming.InitialContext; +import javax.naming.NamingException; +import javax.sql.DataSource; + +public class DBConnect { + + private static volatile DataSource pooledDataSource; + + public Connection connect(String path) throws IOException, ClassNotFoundException, SQLException { + DataSource ds = lookupPool(); + if (ds != null) { + return ds.getConnection(); + } + return legacyConnect(path); + } + + private static DataSource lookupPool() { + DataSource ds = pooledDataSource; + if (ds != null) { + return ds; + } + synchronized (DBConnect.class) { + if (pooledDataSource == null) { + try { + Context envCtx = (Context) new InitialContext().lookup("java:comp/env"); + pooledDataSource = (DataSource) envCtx.lookup("jdbc/jvl"); + } catch (NamingException e) { + return null; + } + } + return pooledDataSource; + } + } + + private static Connection legacyConnect(String path) throws IOException, ClassNotFoundException, SQLException { + Properties properties = new Properties(); + FileInputStream in = new FileInputStream(path); + try { + properties.load(in); + } finally { + in.close(); + } + String dbuser = properties.getProperty("dbuser"); + String dbpass = properties.getProperty("dbpass"); + String dbfullurl = properties.getProperty("dburl") + properties.getProperty("dbname"); + String jdbcdriver = properties.getProperty("jdbcdriver"); + Class.forName(jdbcdriver); + return DriverManager.getConnection(dbfullurl, dbuser, dbpass); + } +} diff --git a/src/java/model/HashMe.java b/src/main/java/org/cysecurity/cspf/jvl/model/HashMe.java similarity index 78% rename from src/java/model/HashMe.java rename to src/main/java/org/cysecurity/cspf/jvl/model/HashMe.java index 5cea4546..635a180d 100644 --- a/src/java/model/HashMe.java +++ b/src/main/java/org/cysecurity/cspf/jvl/model/HashMe.java @@ -1,10 +1,4 @@ -/* - * To change this license header, choose License Headers in Project Properties. - * To change this template file, choose Tools | Templates - * and open the template in the editor. - */ - -package model; +package org.cysecurity.cspf.jvl.model; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; diff --git a/src/main/java/org/cysecurity/cspf/jvl/model/JwtUtil.java b/src/main/java/org/cysecurity/cspf/jvl/model/JwtUtil.java new file mode 100644 index 00000000..bd2b33e2 --- /dev/null +++ b/src/main/java/org/cysecurity/cspf/jvl/model/JwtUtil.java @@ -0,0 +1,80 @@ +package org.cysecurity.cspf.jvl.model; + +import java.nio.charset.Charset; +import javax.crypto.Mac; +import javax.crypto.spec.SecretKeySpec; +import javax.xml.bind.DatatypeConverter; + +/** + * Minimal HS256 JWT helper for the lab. + * + * sign() produces a genuinely signed token so that a correct verifier (see the + * A01 slides) would reject any tampering. decodePayload() deliberately reads the + * claims WITHOUT checking the signature: that omission is the vulnerability the + * baac/ page demonstrates, not a bug in this helper. + * + * DatatypeConverter (JAXB) is used instead of java.util.Base64 so the code runs + * on the Java 7 target as well as the Java 8 build JDK. + */ +public final class JwtUtil { + + private static final Charset UTF8 = Charset.forName("UTF-8"); + + // Demo secret. A real deployment keeps a strong, rotated key server-side only. + private static final byte[] SECRET = "jvl-demo-hs256-secret-do-not-reuse".getBytes(UTF8); + + private JwtUtil() { + } + + public static String sign(String subject, String role) { + String header = "{\"alg\":\"HS256\",\"typ\":\"JWT\"}"; + long now = System.currentTimeMillis() / 1000L; + String payload = "{\"sub\":\"" + escape(subject) + "\",\"role\":\"" + escape(role) + + "\",\"iss\":\"jvl\",\"iat\":" + now + ",\"exp\":" + (now + 3600L) + "}"; + + String signingInput = base64Url(header.getBytes(UTF8)) + "." + base64Url(payload.getBytes(UTF8)); + return signingInput + "." + base64Url(hmacSha256(signingInput.getBytes(UTF8))); + } + + /** Returns the raw claims JSON. Does NOT verify the signature (intentional for the lab). */ + public static String decodePayload(String token) { + String[] parts = token.split("\\."); + if (parts.length < 2) { + return "{}"; + } + return new String(base64UrlDecode(parts[1]), UTF8); + } + + private static byte[] hmacSha256(byte[] data) { + try { + Mac mac = Mac.getInstance("HmacSHA256"); + mac.init(new SecretKeySpec(SECRET, "HmacSHA256")); + return mac.doFinal(data); + } catch (Exception e) { + throw new RuntimeException("HMAC failure", e); + } + } + + private static String base64Url(byte[] data) { + return DatatypeConverter.printBase64Binary(data) + .replace('+', '-').replace('/', '_').replace("=", ""); + } + + private static byte[] base64UrlDecode(String s) { + String t = s.replace('-', '+').replace('_', '/'); + int rem = t.length() % 4; + if (rem == 2) { + t += "=="; + } else if (rem == 3) { + t += "="; + } + return DatatypeConverter.parseBase64Binary(t); + } + + private static String escape(String s) { + if (s == null) { + return ""; + } + return s.replace("\\", "\\\\").replace("\"", "\\\""); + } +} diff --git a/src/main/java/org/cysecurity/cspf/jvl/model/Preferences.java b/src/main/java/org/cysecurity/cspf/jvl/model/Preferences.java new file mode 100644 index 00000000..c914feef --- /dev/null +++ b/src/main/java/org/cysecurity/cspf/jvl/model/Preferences.java @@ -0,0 +1,48 @@ +package org.cysecurity.cspf.jvl.model; + +import java.io.Serializable; + +/** + * User-interface preferences that the app round-trips through the client as a + * serialized Java object (the "view state"). The blob is deserialized back on + * the server, which is the sink for the insecure-deserialization demo in + * vulnerability/deserialize/preferences.jsp (OWASP 2025 A08, CWE-502). + */ +public class Preferences implements Serializable { + + private static final long serialVersionUID = 1L; + + private String theme; + private String language; + private int itemsPerPage; + + public Preferences() { + this.theme = "light"; + this.language = "en"; + this.itemsPerPage = 20; + } + + public String getTheme() { + return theme; + } + + public void setTheme(String theme) { + this.theme = theme; + } + + public String getLanguage() { + return language; + } + + public void setLanguage(String language) { + this.language = language; + } + + public int getItemsPerPage() { + return itemsPerPage; + } + + public void setItemsPerPage(int itemsPerPage) { + this.itemsPerPage = itemsPerPage; + } +} diff --git a/src/main/java/org/cysecurity/cspf/jvl/model/orm/Users.java b/src/main/java/org/cysecurity/cspf/jvl/model/orm/Users.java new file mode 100644 index 00000000..7c94f644 --- /dev/null +++ b/src/main/java/org/cysecurity/cspf/jvl/model/orm/Users.java @@ -0,0 +1,36 @@ +/* + * To change this license header, choose License Headers in Project Properties. + * To change this template file, choose Tools | Templates + * and open the template in the editor. + */ + +package org.cysecurity.cspf.jvl.model.orm; + +/** + * + * @author breakthesec + */ +public class Users { + Long id; + String username; + String about; + + public Long getId() { + return id; + } + private void setId(Long id) { + this.id = id; + } + public String getUsername() { + return username; + } + public void setUsername(String username) { + this.username = username; + } + public String getAbout() { + return about; + } + public void setAbout(String about) { + this.about = about; + } +} diff --git a/src/main/resources/Users.hbm.xml b/src/main/resources/Users.hbm.xml new file mode 100644 index 00000000..e8f5b6a2 --- /dev/null +++ b/src/main/resources/Users.hbm.xml @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/main/resources/log4j2.xml b/src/main/resources/log4j2.xml new file mode 100644 index 00000000..ab8a49fe --- /dev/null +++ b/src/main/resources/log4j2.xml @@ -0,0 +1,13 @@ + + + + + + + + + + + + + diff --git a/web/ForgotPassword.jsp b/src/main/webapp/ForgotPassword.jsp similarity index 97% rename from web/ForgotPassword.jsp rename to src/main/webapp/ForgotPassword.jsp index ea6a01fd..b56f6cba 100644 --- a/web/ForgotPassword.jsp +++ b/src/main/webapp/ForgotPassword.jsp @@ -1,5 +1,5 @@ - <%@page import="model.DBConnect"%> + <%@page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page import="java.sql.Statement"%> <%@page import="java.sql.ResultSet"%> <%@page import="java.sql.Connection"%> diff --git a/src/main/webapp/META-INF/context.xml b/src/main/webapp/META-INF/context.xml new file mode 100644 index 00000000..e3d923dd --- /dev/null +++ b/src/main/webapp/META-INF/context.xml @@ -0,0 +1,22 @@ + + + + diff --git a/web/Register.jsp b/src/main/webapp/Register.jsp similarity index 100% rename from web/Register.jsp rename to src/main/webapp/Register.jsp diff --git a/web/WEB-INF/AdminPanel.jsp b/src/main/webapp/WEB-INF/AdminPanel.jsp similarity index 100% rename from web/WEB-INF/AdminPanel.jsp rename to src/main/webapp/WEB-INF/AdminPanel.jsp diff --git a/src/main/webapp/WEB-INF/config.properties b/src/main/webapp/WEB-INF/config.properties new file mode 100644 index 00000000..ae13b151 --- /dev/null +++ b/src/main/webapp/WEB-INF/config.properties @@ -0,0 +1,22 @@ +# To change this license header, choose License Headers in Project Properties. +# To change this template file, choose Tools | Templates +# and open the template in the editor. + +dbuser=root +dbpass=root +dbname=abc +dburl=jdbc:mysql://mysql:3306/ +jdbcdriver=com.mysql.jdbc.Driver +siteTitle=Java Vulnerable Lab + +# Developer debug mode, the same switch as Django's DEBUG and Laravel's +# APP_DEBUG. Left as true on purpose: that IS the misconfiguration demonstrated +# by vulnerability/debugmode/orders.jsp. Toggle from admin/Configure.jsp. +debug=true + +# Third-party promo widget loaded by vulnerability/integrity/checkout.jsp, +# both set from admin/WidgetSource.jsp. Empty widgetScriptUrl means "the demo +# widget server on whatever host the browser used", so no host is baked in. +# widgetScriptIntegrity is empty on purpose: no Subresource Integrity check. +widgetScriptUrl= +widgetScriptIntegrity= diff --git a/web/WEB-INF/users.xml b/src/main/webapp/WEB-INF/users.xml similarity index 100% rename from web/WEB-INF/users.xml rename to src/main/webapp/WEB-INF/users.xml diff --git a/src/main/webapp/WEB-INF/web.xml b/src/main/webapp/WEB-INF/web.xml new file mode 100644 index 00000000..a6ee66d2 --- /dev/null +++ b/src/main/webapp/WEB-INF/web.xml @@ -0,0 +1,150 @@ + + + + + + Install + org.cysecurity.cspf.jvl.controller.Install + + + loginValidator + org.cysecurity.cspf.jvl.controller.LoginValidator + + + Register + org.cysecurity.cspf.jvl.controller.Register + + + Logout + org.cysecurity.cspf.jvl.controller.Logout + + + Open + org.cysecurity.cspf.jvl.controller.Open + + + SendMessage + org.cysecurity.cspf.jvl.controller.SendMessage + + + ForwardMe + org.cysecurity.cspf.jvl.controller.ForwardMe + + + AddPage + org.cysecurity.cspf.jvl.controller.AddPage + + + UsernameCheck + org.cysecurity.cspf.jvl.controller.UsernameCheck + + + EmailCheck + org.cysecurity.cspf.jvl.controller.EmailCheck + + + XPathQuery + org.cysecurity.cspf.jvl.controller.XPathQuery + + + xxe + org.cysecurity.cspf.jvl.controller.xxe + + + Transfer + org.cysecurity.cspf.jvl.controller.Transfer + + + + Transfer + /Transfer.do + + + Install + /Install + + + loginValidator + /LoginValidator + + + Register + /AddUser + + + Logout + /Logout + + + Open + /Open + + + SendMessage + /SendMessage.do + + + ForwardMe + /ForwardMe + + + AddPage + /admin/AddPage.do + + + UsernameCheck + /UsernameCheck.do + + + EmailCheck + /EmailCheck.do + + + XPathQuery + /XPathQuery.do + + + xxe + /xxe.do + + + + AvatarUpload + org.cysecurity.cspf.jvl.controller.AvatarUpload + + + AvatarUpload + /UploadAvatar + + + + jdbc/jvl + javax.sql.DataSource + Container + + + + + default + org.apache.catalina.servlets.DefaultServlet + + debug + 0 + + + listings + true + + 1 + + + default + / + + + diff --git a/src/main/webapp/WEB-INF/widget-source.jspf b/src/main/webapp/WEB-INF/widget-source.jspf new file mode 100644 index 00000000..42aec9af --- /dev/null +++ b/src/main/webapp/WEB-INF/widget-source.jspf @@ -0,0 +1,44 @@ +<%-- + widget-source.jspf - shared config for the third-party "promo widget" + [OWASP 2025 A08 Software or Data Integrity Failures, + CWE-830 Inclusion of Web Functionality from an Untrusted Source] + + The URL of the third-party script, and its optional Subresource Integrity + hash, are kept in WEB-INF/config.properties so the admin screen can change + them at runtime. In a real application the URL would simply be hard-coded + in the page by whoever added the vendor's snippet. + + Both settings are empty by default. An empty script URL falls back to the + demo widget server on whatever host the browser used to reach this page, + so the lab works unchanged on localhost, on a VM's IP, or behind a + hostname. Nothing here assumes localhost. +--%> +<%@page import="java.util.Properties"%> +<%! + static final String WIDGET_URL_KEY = "widgetScriptUrl"; + static final String WIDGET_SRI_KEY = "widgetScriptIntegrity"; + static final int WIDGET_DEMO_PORT = 8000; + + /** + * Where the demo widget server is expected to be: same host the browser is + * already talking to, port 8000. Derived per request, never hard-coded. + */ + static String defaultWidgetUrl(HttpServletRequest request) { + return "http://" + request.getServerName() + ":" + WIDGET_DEMO_PORT + + "/promo-widget.js"; + } + + /** Escape a value for use inside a double-quoted HTML attribute or as text. */ + static String esc(String value) { + if (value == null) { + return ""; + } + return value.replace("&", "&").replace("<", "<") + .replace(">", ">").replace("\"", """); + } + + static String widgetSetting(Properties props, String key, String fallback) { + String value = props == null ? null : props.getProperty(key); + return (value == null || value.trim().length() == 0) ? fallback : value.trim(); + } +%> diff --git a/web/admin/AddPage.jsp b/src/main/webapp/admin/AddPage.jsp similarity index 100% rename from web/admin/AddPage.jsp rename to src/main/webapp/admin/AddPage.jsp diff --git a/web/admin/Configure.jsp b/src/main/webapp/admin/Configure.jsp similarity index 54% rename from web/admin/Configure.jsp rename to src/main/webapp/admin/Configure.jsp index d60ca8b0..ee5aaf1e 100644 --- a/web/admin/Configure.jsp +++ b/src/main/webapp/admin/Configure.jsp @@ -5,22 +5,32 @@ { %> +<% + Properties current=new Properties(); + FileInputStream currentIn=new FileInputStream(configPath); + current.load(currentIn); + currentIn.close(); + boolean debugOn="true".equalsIgnoreCase(current.getProperty("debug","false")); + %>
- - +
Website Title:
+ + -
Website Title: "/>
Debug mode: /> + show developer error pages to users (Django DEBUG / Laravel APP_DEBUG)
+
- + <% if(request.getParameter("save")!=null) { Properties props=new Properties(); - + props.load(new FileInputStream(configPath)); props.setProperty("siteTitle",request.getParameter("siteTitle")); + props.setProperty("debug", request.getParameter("debug")!=null ? "true" : "false"); FileOutputStream fileout = new FileOutputStream(configPath); - props.store(fileout, null); + props.store(fileout, null); fileout.close(); out.print(" Configuration saved "); } diff --git a/src/main/webapp/admin/WidgetSource.jsp b/src/main/webapp/admin/WidgetSource.jsp new file mode 100644 index 00000000..69044d86 --- /dev/null +++ b/src/main/webapp/admin/WidgetSource.jsp @@ -0,0 +1,143 @@ +<%-- + WidgetSource.jsp - demo control for the third-party promo widget + [supports the A08 / CWE-830 demo in vulnerability/integrity/checkout.jsp] + + THIS SCREEN IS NOT THE VULNERABILITY. It is an admin-only setting that + writes the widget's script URL (and its optional Subresource Integrity + hash) into WEB-INF/config.properties, so a presenter can repoint the + checkout page at another host without redeploying the application. + + In a real application there is no such screen: a developer pastes the + vendor's "); %> + + + +
+ + + +
+ + +
+ diff --git a/web/images/Thumbs.db b/src/main/webapp/images/Thumbs.db similarity index 100% rename from web/images/Thumbs.db rename to src/main/webapp/images/Thumbs.db diff --git a/web/images/bg.png b/src/main/webapp/images/bg.png similarity index 100% rename from web/images/bg.png rename to src/main/webapp/images/bg.png diff --git a/web/index.jsp b/src/main/webapp/index.jsp similarity index 100% rename from web/index.jsp rename to src/main/webapp/index.jsp diff --git a/web/install.jsp b/src/main/webapp/install.jsp similarity index 93% rename from web/install.jsp rename to src/main/webapp/install.jsp index 457a708e..dfbe8f73 100644 --- a/web/install.jsp +++ b/src/main/webapp/install.jsp @@ -3,14 +3,14 @@ <%@ include file="/header.jsp" %> -
+ - + diff --git a/web/jquery.min.js b/src/main/webapp/jquery.min.js similarity index 100% rename from web/jquery.min.js rename to src/main/webapp/jquery.min.js diff --git a/web/login.jsp b/src/main/webapp/login.jsp similarity index 75% rename from web/login.jsp rename to src/main/webapp/login.jsp index 3b208460..171ee03e 100644 --- a/web/login.jsp +++ b/src/main/webapp/login.jsp @@ -17,7 +17,10 @@ } %> - +<%-- encodeURL keeps the session alive for clients the container cannot confirm + accept cookies: it appends ;jsessionid= when the id arrived in the URL, and + returns the action untouched for a normal cookie-carrying browser. --%> +" method="post">
Website Title:
Database Name:
Database User:
Database Password:
JDBC Driver:
JDBC URL:
JDBC URL:
Admin Login Credential:
Username(Default):
Password(Default):
diff --git a/web/myprofile.jsp b/src/main/webapp/myprofile.jsp similarity index 97% rename from web/myprofile.jsp rename to src/main/webapp/myprofile.jsp index 8b165d2d..d9eb99de 100644 --- a/web/myprofile.jsp +++ b/src/main/webapp/myprofile.jsp @@ -6,7 +6,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% if(session.getAttribute("isLoggedIn")!=null) diff --git a/web/robots.txt b/src/main/webapp/robots.txt similarity index 100% rename from web/robots.txt rename to src/main/webapp/robots.txt diff --git a/src/main/webapp/style.css b/src/main/webapp/style.css new file mode 100644 index 00000000..1780b50a --- /dev/null +++ b/src/main/webapp/style.css @@ -0,0 +1,464 @@ +/* ============================================================================ + Java Vulnerable Lab - modern dark UI (neutral slate surfaces, one indigo + accent). CSS-only refresh: all element IDs, the menu markup and the + hover-dropdown mechanics are unchanged. Only presentation moved. + ============================================================================ */ + +:root { + --bg: #0e0f13; + --surface: #16181f; /* cards / navbar */ + --elevated: #1d2029; /* dropdowns, inputs */ + --line: rgba(255,255,255,.08); + --line-soft: rgba(255,255,255,.06); + --text: #e6e7ea; + --muted: #9399a5; + --accent: #7c5cff; /* indigo */ + --accent-2: #a78bfa; /* violet */ + --accent-tint: rgba(124,92,255,.14); + --good: #45d19a; + --bad: #ff6b81; + --radius: 12px; + --shadow: 0 10px 30px rgba(0,0,0,.45); +} + +*, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; } + +body { + background-color: var(--bg); + background-image: + radial-gradient(760px 440px at -6% -10%, rgba(124,92,255,.18), transparent 60%), /* indigo glow, top-left */ + radial-gradient(720px 460px at 106% 112%, rgba(206,44,85,.13), transparent 60%), /* crimson glow, bottom-right */ + radial-gradient(rgba(255,255,255,.045) 1px, transparent 1px); /* faint dot grid */ + background-size: 100% 100%, 100% 100%, 24px 24px; + background-repeat: no-repeat, no-repeat, repeat; + background-attachment: fixed; + color: var(--text); + font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Inter, Helvetica, Arial, sans-serif; + font-size: 16px; + line-height: 1.65; + letter-spacing: .1px; + min-height: 100vh; + -webkit-font-smoothing: antialiased; +} + +a { color: var(--accent-2); text-decoration: none; transition: color .15s ease; } +a:hover { color: #c9bcff; } + +p { margin: 16px 0; } +h1, h2, h3 { line-height: 1.25; } +hr { border: none; border-top: 1px solid var(--line); margin: 18px 0; } + +.more { float: right; font-size: 11px; color: var(--accent-2); font-weight: 600; } +.clear { clear: both; } +.success { color: var(--good); font-weight: 600; } +.fail { color: var(--bad); font-weight: 600; } + +/* ------------------------------------------------------------------ shell -- */ +#container { + width: min(1120px, 84%); + margin: 26px auto 48px; + /* bakes in the "110% browser zoom" look: scales fonts, spacing and the whole + panel up ~10% together. Width cap trimmed to 84% so 1.1x never overflows. */ + zoom: 1.1; +} + +/* content card = body of the panel: no top border/radius so it joins the navbar */ +#Main-Container { + width: 100%; + overflow: hidden; + background: + linear-gradient(180deg, rgba(255,255,255,.02), transparent 120px), + var(--surface); + border: 1px solid var(--line); + border-top: none; + border-radius: 0 0 16px 16px; + box-shadow: var(--shadow); + padding: 0 36px 36px; +} + +/* hero band: brand + badge, bleeds to the panel edges, glows */ +#logo { + width: auto; + text-align: center; + margin: 0 -36px 22px; + padding: 26px 0 20px; + border-bottom: 1px solid var(--line); + background: radial-gradient(620px 180px at 50% -20%, rgba(124,92,255,.20), transparent 68%); +} +#logo h1 { + display: inline-block; + font-size: 32px; + font-weight: 800; + letter-spacing: .3px; + background: linear-gradient(90deg, #d9ccff, var(--accent-2), var(--accent)); + -webkit-background-clip: text; + background-clip: text; + color: transparent; +} +#logo::after { + content: "OWASP Top 10"; + display: block; + width: -moz-fit-content; + width: fit-content; + margin: 12px auto 0; + padding: 5px 15px; + font-size: 12px; + font-weight: 700; + letter-spacing: 1.2px; + text-transform: uppercase; + color: #c9bcff; + background: var(--accent-tint); + border: 1px solid rgba(124,92,255,.38); + border-radius: 999px; +} + +#Main { + width: auto; + max-width: 880px; + height: auto; + min-height: 220px; + margin: 0 auto; + padding-top: 8px; +} +#Main h2 { color: #f2f2f5; font-size: 23px; font-weight: 700; padding: 0 0 12px 2px; } +#Main h3 { color: var(--accent-2); font-size: 18px; margin: 14px 0 8px; } + +#left { float: left; width: 435px; margin: 0 0 0 40px; display: inline; } +#right { float: right; width: 258px; height: auto; margin: 0 40px 20px 0; display: inline; } +#right a img { margin: 8px 8px 8px 0; border: none; border-radius: 8px; } + +/* --------------------------------------------------------------- nav bar -- */ +/* navbar = header strip of the single panel: flush on top of the content card */ +#menu-bar { + width: 100%; + display: block; + position: relative; + z-index: 100; + margin: 0; + padding: 10px 10px 7px; + height: auto; + background: var(--surface); + border: 1px solid var(--line); + border-bottom: 1px solid var(--line); + border-radius: 16px 16px 0 0; + box-shadow: none; +} +#menu-bar::before { + content: ""; + position: absolute; + top: 0; left: 0; right: 0; + height: 3px; + background: linear-gradient(90deg, var(--accent) 0%, var(--accent-2) 52%, #ce2c55 112%); + border-radius: 16px 16px 0 0; +} +#menu-bar li { + margin: 0 1px; + padding: 0; + float: left; + position: relative; + list-style: none; +} +#menu-bar a { + font-weight: 600; + font-size: 15px; + color: var(--text); + display: block; + padding: 10px 18px; + border-radius: 9px; + white-space: nowrap; + transition: background .15s ease, color .15s ease; +} +#menu-bar > li > a::after { + content: ""; +} +/* caret only on top-level items that actually have a submenu */ +#menu-bar > li:has(> ul) > a::after { + content: " \25be"; + color: var(--muted); + font-size: 10px; +} +#menu-bar .current a, +#menu-bar > li:hover > a { + background: var(--accent-tint); + color: #d8ccff; +} + +/* dropdown panels -------------------------------------------------------- */ +#menu-bar ul { + background: var(--elevated); + display: block; + visibility: hidden; + opacity: 0; + transform: translateY(6px); + /* Grace period: when the cursor leaves, keep the menu fully shown for ~0.25s + before fading, so moving into a submenu (or across a tiny seam) does not + collapse the whole chain. Opening stays instant (see :hover rule). */ + transition: opacity .15s ease .25s, transform .15s ease .25s, visibility 0s linear .42s; + margin: 0; + padding: 6px; + width: auto; + min-width: 250px; + position: absolute; + top: 100%; + left: 0; + border: 1px solid var(--line); + border-radius: 12px; + box-shadow: 0 16px 34px rgba(0,0,0,.55); + z-index: 50; +} +#menu-bar li:hover > ul { + visibility: visible; + opacity: 1; + transform: translateY(0); + transition: opacity .14s ease 0s, transform .14s ease 0s, visibility 0s linear 0s; +} +#menu-bar ul li { float: none; margin: 0; padding: 0; } +#menu-bar ul li:hover a, +#menu-bar li:hover li a { + background: none; + border: none; + color: var(--text); + box-shadow: none; +} +#menu-bar ul a { + padding: 10px 14px; + color: var(--text) !important; + font-size: 14px; + font-weight: 500; + white-space: nowrap; + border-radius: 8px; + position: relative; + transition: background .12s ease, color .12s ease; +} +#menu-bar ul a:hover { + background: var(--accent) !important; + color: #fff !important; + border-radius: 8px; +} +/* mark dropdown items that expand into a side submenu (arrow pinned right) */ +#menu-bar ul li:has(> ul) > a { padding-right: 28px; } +#menu-bar ul li:has(> ul) > a::after { + content: "\25B8"; + position: absolute; + right: 11px; + top: 50%; + transform: translateY(-50%); + color: var(--muted); + font-size: 11px; +} +#menu-bar ul li:has(> ul):hover > a::after { color: #fff; } +#menu-bar ul li:first-child > a, +#menu-bar ul li:last-child > a { border-radius: 8px; } + +#menu-bar:after { + content: "."; + display: block; + clear: both; + visibility: hidden; + line-height: 0; + height: 0; +} +html[xmlns] #menu-bar { display: block; } +* html #menu-bar { height: 1%; } + +/* nested (3rd level) submenu opens to the side, flush against the parent (no + gap) so the cursor never crosses empty space and loses hover */ +#menu-bar ul li ul { + left: 100%; + top: -7px; + background: var(--elevated); +} + +/* --------------------------------------------------------------- content -- */ +input[type=text], input[type=password], input[type=email], +input[type=number], input[type=search], input[type=url], +textarea, select { + background: var(--elevated); + color: var(--text); + border: 1px solid rgba(255,255,255,.14); + border-radius: 8px; + padding: 10px 12px; + font-size: 15px; + font-family: inherit; + outline: none; + transition: border-color .15s ease, box-shadow .15s ease; + max-width: 100%; +} +input::placeholder, textarea::placeholder { color: #6d7280; } +input[type=text]:focus, input[type=password]:focus, input[type=email]:focus, +input[type=number]:focus, input[type=search]:focus, input[type=url]:focus, +textarea:focus, select:focus { + border-color: var(--accent); + box-shadow: 0 0 0 3px rgba(124,92,255,.28); +} + +input[type=submit], input[type=button], input[type=reset], button { + background: var(--accent); + color: #fff; + border: none; + border-radius: 8px; + padding: 10px 20px; + font-size: 15px; + font-weight: 600; + font-family: inherit; + cursor: pointer; + transition: background .15s ease, transform .05s ease; +} +input[type=submit]:hover, input[type=button]:hover, button:hover { background: #6b4aee; } +input[type=submit]:active, button:active { transform: translateY(1px); } + +table { border-collapse: collapse; margin: 8px 0; } +th, td { padding: 8px 12px; vertical-align: top; text-align: left; } +th { color: var(--accent-2); font-weight: 600; } + +pre { + background: #0b0c11; + border: 1px solid var(--line); + border-radius: 8px; + padding: 12px 14px; + overflow: auto; + line-height: 1.5; +} +code, pre, kbd { + font-family: ui-monospace, "SF Mono", Menlo, Consolas, "Liberation Mono", monospace; + font-size: 13px; +} +code { + background: var(--accent-tint); + color: #c9bcff; + padding: 1px 6px; + border-radius: 6px; +} +pre code { background: none; color: inherit; padding: 0; } + +/* ---------------------------------------------------------------------------- + Lab notes: teaching text appended to a vulnerable page. Boxed and captioned + so it reads as commentary about the page, never as part of the application. + ---------------------------------------------------------------------------- */ +.labnote { + margin: 30px 0 6px; + padding: 14px 18px 18px; + border: 1px dashed var(--line); + border-left: 3px solid var(--accent); + border-radius: var(--radius); + background: rgba(124,92,255,.05); + color: var(--muted); + font-size: 15px; +} +.labnote-title { + display: block; + margin-bottom: 10px; + color: var(--accent-2); + font-size: 11px; + font-weight: 700; + letter-spacing: .14em; + text-transform: uppercase; +} +.labnote b, .labnote strong { color: var(--text); } + +/* ---- Debug-mode developer error page (vulnerability/debugmode/orders.jsp) ---- */ +.dbg { + margin: 18px 0; + border: 1px solid #b3452f; + border-radius: var(--radius); + background: #1b1016; + overflow: hidden; + font-size: 14px; +} +.dbg-head { + padding: 16px 18px; + background: linear-gradient(180deg, #4a1d1d, #331419); + border-bottom: 1px solid #b3452f; + font-family: var(--font-mono, monospace); + color: #ffd9d2; +} +.dbg-badge { + display: inline-block; + margin-right: 10px; + padding: 2px 8px; + border-radius: 4px; + background: #d9482f; + color: #fff; + font-size: 11px; + font-weight: 700; + letter-spacing: .16em; +} +.dbg-msg { margin-top: 8px; font-size: 17px; color: #fff; font-weight: 600; } +.dbg-sub { margin-top: 6px; font-size: 12px; color: #e0a89c; } +.dbg-sec { + padding: 9px 18px; + background: #2a1620; + border-top: 1px solid #55212a; + color: #ff9d85; + font-size: 11px; + font-weight: 700; + letter-spacing: .14em; + text-transform: uppercase; +} +.dbg-sec span { text-transform: none; letter-spacing: 0; color: var(--muted); font-weight: 400; } +.dbg-t { width: 100%; border-collapse: collapse; font-family: var(--font-mono, monospace); font-size: 12.5px; } +.dbg-t td { padding: 5px 18px; border-top: 1px solid #2b1a20; color: #ffe9e3; word-break: break-all; } +.dbg-t .dbg-k { width: 240px; color: #ff9d85; white-space: nowrap; } +.dbg-trace { + margin: 0; + padding: 14px 18px; + background: #140c10; + color: #cbbfc6; + font-size: 12px; + line-height: 1.5; + overflow-x: auto; + white-space: pre; +} +.dbg-safe { + margin: 18px 0; + padding: 16px 18px; + border: 1px solid var(--line); + border-radius: var(--radius); + background: rgba(255,255,255,.03); +} + +/* ---- One-time-code transfer flow (vulnerability/otp/*.jsp) ---- */ +.otp-card { + margin: 18px 0; + padding: 18px 20px; + border: 1px solid var(--line); + border-radius: var(--radius); + background: rgba(255,255,255,.03); +} +.otp-step { + margin-bottom: 12px; + color: var(--accent-2); + font-size: 11px; + font-weight: 700; + letter-spacing: .14em; + text-transform: uppercase; +} +.otp-card table td { padding: 4px 10px 4px 0; } +.otp-card .fail { margin-left: 12px; } + +.otp-receipt { + max-width: 420px; + margin: 18px 0; + padding: 20px 22px; + border: 1px solid rgba(69,209,154,.35); + border-radius: var(--radius); + background: rgba(69,209,154,.07); +} +.otp-receipt-amt { font-size: 30px; font-weight: 700; color: var(--good); } +.otp-receipt-to { margin-bottom: 12px; color: var(--muted); } +.otp-receipt-t { width: 100%; border-collapse: collapse; font-size: 14px; } +.otp-receipt-t td { padding: 6px 0; border-top: 1px solid var(--line); } +.otp-receipt-t td:first-child { color: var(--muted); width: 45%; } + +.otp-ledger { width: 100%; border-collapse: collapse; font-size: 14px; } +.otp-ledger th { + padding: 8px 10px; + border-bottom: 1px solid var(--line); + color: var(--muted); + font-size: 11px; + font-weight: 700; + letter-spacing: .12em; + text-transform: uppercase; + text-align: left; +} +.otp-ledger td { padding: 8px 10px; border-bottom: 1px solid var(--line-soft); } diff --git a/web/vulnerability/DisplayMessage.jsp b/src/main/webapp/vulnerability/DisplayMessage.jsp similarity index 96% rename from web/vulnerability/DisplayMessage.jsp rename to src/main/webapp/vulnerability/DisplayMessage.jsp index bdd332eb..dfad1d01 100644 --- a/web/vulnerability/DisplayMessage.jsp +++ b/src/main/webapp/vulnerability/DisplayMessage.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% if(session.getAttribute("isLoggedIn")!=null) { diff --git a/web/vulnerability/Injection/1.xsl b/src/main/webapp/vulnerability/Injection/1.xsl similarity index 100% rename from web/vulnerability/Injection/1.xsl rename to src/main/webapp/vulnerability/Injection/1.xsl diff --git a/web/vulnerability/Injection/2.xsl b/src/main/webapp/vulnerability/Injection/2.xsl similarity index 100% rename from web/vulnerability/Injection/2.xsl rename to src/main/webapp/vulnerability/Injection/2.xsl diff --git a/src/main/webapp/vulnerability/Injection/Users.hbm.xml b/src/main/webapp/vulnerability/Injection/Users.hbm.xml new file mode 100644 index 00000000..34bc5929 --- /dev/null +++ b/src/main/webapp/vulnerability/Injection/Users.hbm.xml @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/web/vulnerability/Injection/courses.xml b/src/main/webapp/vulnerability/Injection/courses.xml similarity index 100% rename from web/vulnerability/Injection/courses.xml rename to src/main/webapp/vulnerability/Injection/courses.xml diff --git a/src/main/webapp/vulnerability/Injection/orm.jsp b/src/main/webapp/vulnerability/Injection/orm.jsp new file mode 100644 index 00000000..4d99eca9 --- /dev/null +++ b/src/main/webapp/vulnerability/Injection/orm.jsp @@ -0,0 +1,60 @@ + +<%@page import="org.hibernate.cfg.Configuration"%> +<%@page import="org.hibernate.SessionFactory"%> +<%@page import="java.util.List"%> +<%@page import="org.cysecurity.cspf.jvl.model.orm.Users"%> +<%@page import="org.hibernate.Query"%> +<%@page import="org.hibernate.Session"%> +<%@ include file="/header.jsp" %> +<%! +private static String queryUsers(Session session,String id) { + Query query = session.createQuery("from Users where id="+id); + List list = query.list(); + java.util.Iterator iter = list.iterator(); + String results="Details:
---------------
"; + if (iter.hasNext()) { + Users users = iter.next(); + results+= "Name: " + users.getUsername() +"
About: " + users.getAbout(); + } + session.getTransaction().commit(); + return results; + + } + +%> +<% + + try{ + + //Reading config from properties file: + String dbuser=properties.getProperty("dbuser"); + String dbpass = properties.getProperty("dbpass"); + String dbfullurl = properties.getProperty("dburl")+properties.getProperty("dbname"); + String jdbcdriver = properties.getProperty("jdbcdriver"); + + Configuration configuration = new Configuration(); + configuration.setProperty( "hibernate.connection.driver_class",jdbcdriver); + configuration.setProperty( "hibernate.connection.url",dbfullurl); + configuration.setProperty( "hibernate.connection.username", dbuser); + configuration.setProperty( "hibernate.connection.password", dbpass); + configuration.setProperty( "hibernate.dialect","org.hibernate.dialect.MySQLDialect"); + + + configuration.addResource("Users.hbm.xml"); + SessionFactory factory; + factory=configuration.buildSessionFactory(); + Session ormSession = factory.openSession(); + + ormSession.beginTransaction(); + + out.print(queryUsers(ormSession,request.getParameter("id"))); + + } + catch(Exception e) + { + out.print(e); + } + + %> + +<%@ include file="/footer.jsp" %> \ No newline at end of file diff --git a/src/main/webapp/vulnerability/Injection/ping.jsp b/src/main/webapp/vulnerability/Injection/ping.jsp new file mode 100644 index 00000000..804c2115 --- /dev/null +++ b/src/main/webapp/vulnerability/Injection/ping.jsp @@ -0,0 +1,38 @@ +<%@page import="java.io.BufferedReader"%> +<%@page import="java.io.InputStreamReader"%> +<%@ include file="/header.jsp" %> +

Network Tools: Ping a Host

+

Check whether a host is reachable from the server.

+ +
UserName:
Password :
+ + +
Host / IP:
+
+<% + String host = request.getParameter("host"); + if (host != null && !host.trim().isEmpty()) { + // VULNERABLE: the host value is concatenated straight into an OS command and + // run through the shell, so metacharacters (; | & && $() `) are interpreted. + // e.g. host = "127.0.0.1; id" -> /bin/sh -c "ping -c 2 127.0.0.1; id" + ProcessBuilder pb = new ProcessBuilder("/bin/sh", "-c", "ping -c 2 " + host); + pb.redirectErrorStream(true); + Process proc = pb.start(); + + StringBuilder sb = new StringBuilder(); + BufferedReader reader = new BufferedReader(new InputStreamReader(proc.getInputStream())); + String line; + while ((line = reader.readLine()) != null) { + sb.append(line).append("\n"); + } + proc.waitFor(); + + String output = sb.toString() + .replace("&", "&").replace("<", "<").replace(">", ">"); +%> +

Result

+ 
<%= output %>
+<% + } +%> +<%@ include file="/footer.jsp" %> diff --git a/web/vulnerability/Injection/xpath_login.jsp b/src/main/webapp/vulnerability/Injection/xpath_login.jsp similarity index 100% rename from web/vulnerability/Injection/xpath_login.jsp rename to src/main/webapp/vulnerability/Injection/xpath_login.jsp diff --git a/src/main/webapp/vulnerability/Injection/xslt.jsp b/src/main/webapp/vulnerability/Injection/xslt.jsp new file mode 100644 index 00000000..6ac291fc --- /dev/null +++ b/src/main/webapp/vulnerability/Injection/xslt.jsp @@ -0,0 +1,32 @@ +<%-- + xslt.jsp - Untrusted XSLT stylesheet [OWASP 2025 A08 Software or Data + Integrity Failures, CWE-494/CWE-829] + + The stylesheet URL is taken straight from the "style" request parameter, so + a client can point the transform at any URL. An XSLT is a program, and it is + executed with NO integrity check on where it came from. + + web.xml declares the Servlet 2.3 DTD, which makes JSP default to + isELIgnored=true, so ${param[...]} would be emitted literally and the page + would just 500. The directive below re-enables EL so the flaw is reachable. + + Fix = never resolve a stylesheet from a request. Map an ID to a server-side + resource and turn on FEATURE_SECURE_PROCESSING. +--%> +<%@ page isELIgnored="false" %> +<%@ include file="/header.jsp" %> +<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %> +<%@ taglib prefix="x" uri="http://java.sun.com/jsp/jstl/xml" %> +
+ Select Style: + +

+ + + + + + <%@ include file="/footer.jsp" %> \ No newline at end of file diff --git a/src/main/webapp/vulnerability/Injection/xxe.jsp b/src/main/webapp/vulnerability/Injection/xxe.jsp new file mode 100644 index 00000000..884b5357 --- /dev/null +++ b/src/main/webapp/vulnerability/Injection/xxe.jsp @@ -0,0 +1,55 @@ +<%@ include file="/header.jsp" %> + + +
+

XML Data Import

+

Paste an XML document describing a user and submit it. The server parses the + document and echoes back each element it read, so you can confirm the import + went through.

+ +
+ +

+ +
+
+ + +<%@ include file="/footer.jsp" %> diff --git a/web/vulnerability/Messages.jsp b/src/main/webapp/vulnerability/Messages.jsp similarity index 95% rename from web/vulnerability/Messages.jsp rename to src/main/webapp/vulnerability/Messages.jsp index e58fc75e..fe2c4b92 100644 --- a/web/vulnerability/Messages.jsp +++ b/src/main/webapp/vulnerability/Messages.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% if(session.getAttribute("isLoggedIn")!=null) { diff --git a/web/vulnerability/SendMessage.jsp b/src/main/webapp/vulnerability/SendMessage.jsp similarity index 94% rename from web/vulnerability/SendMessage.jsp rename to src/main/webapp/vulnerability/SendMessage.jsp index e28563e9..1ce0f03c 100644 --- a/web/vulnerability/SendMessage.jsp +++ b/src/main/webapp/vulnerability/SendMessage.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% if(session.getAttribute("isLoggedIn")!=null) { diff --git a/web/vulnerability/UserDetails.jsp b/src/main/webapp/vulnerability/UserDetails.jsp similarity index 95% rename from web/vulnerability/UserDetails.jsp rename to src/main/webapp/vulnerability/UserDetails.jsp index fd435299..d7a10439 100644 --- a/web/vulnerability/UserDetails.jsp +++ b/src/main/webapp/vulnerability/UserDetails.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties")); String username=request.getParameter("username"); diff --git a/src/main/webapp/vulnerability/baac/index.jsp b/src/main/webapp/vulnerability/baac/index.jsp new file mode 100644 index 00000000..c6600931 --- /dev/null +++ b/src/main/webapp/vulnerability/baac/index.jsp @@ -0,0 +1,55 @@ +<%@page import="org.json.JSONObject"%> +<%@page import="org.cysecurity.cspf.jvl.model.JwtUtil"%> +<%@ include file="/header.jsp" %> +

Account Settings

+<% + if (session.getAttribute("isLoggedIn") == null) { +%> + x Please log in first. +<% + } else { + String token = null; + Cookie[] cookies = request.getCookies(); + if (cookies != null) { + for (Cookie c : cookies) { + if ("jwt".equals(c.getName())) { + token = c.getValue(); + } + } + } + + String role = "guest"; + if (token != null) { + // VULNERABLE: the role claim is read from the JWT payload, but the + // token's signature is never verified. Any client can rewrite the + // payload (e.g. "role":"user" -> "role":"admin") and be trusted. + String claims = JwtUtil.decodePayload(token); + role = new JSONObject(claims).optString("role", "guest"); + } + + out.print("

Signed in as " + session.getAttribute("user") + ". Token role: " + role + "

"); + + if ("admin".equals(role)) { +%> +
+ ✔ Admin access granted. +

Admin-only action unlocked: JVL{jwt_role_claim_was_trusted_without_verification}

+
+ New site announcement: + + +
+<% + if (request.getParameter("save") != null) { + out.print("Announcement published by admin."); + } +%> +
+<% + } else { + out.print("x You are not authorized to view this page.
"); + out.print("✔ only admin can perform this action"); + } + } +%> +<%@ include file="/footer.jsp" %> diff --git a/web/vulnerability/baasm/SiteTitle.jsp b/src/main/webapp/vulnerability/baasm/SiteTitle.jsp similarity index 100% rename from web/vulnerability/baasm/SiteTitle.jsp rename to src/main/webapp/vulnerability/baasm/SiteTitle.jsp diff --git a/src/main/webapp/vulnerability/baasm/URLRewriting.jsp b/src/main/webapp/vulnerability/baasm/URLRewriting.jsp new file mode 100644 index 00000000..72c09e9c --- /dev/null +++ b/src/main/webapp/vulnerability/baasm/URLRewriting.jsp @@ -0,0 +1,37 @@ +<%-- + URLRewriting.jsp - Session ID exposed in a URL + [OWASP 2025 A07 Authentication Failures, CWE-384 / CWE-598] + + A "continue on another device" handoff link. The link is built on the server + and carries the session id as a path parameter, which is exactly what + response.encodeURL() emits whenever the container cannot confirm the client + accepts cookies. Link generation for emails, QR codes and share buttons is + where that condition is met in practice, because there is no browser in the + loop to have returned a cookie. + + The URL is therefore a bearer token. Anyone who receives it becomes the user. + Paired with LoginValidator's missing session rotation it is also the delivery + half of session fixation: hand the link to someone before they log in, and + their login upgrades the session the sender is already holding. + + Fix = keep the session id in a cookie only (tracking-mode COOKIE, HttpOnly, + Secure, SameSite), and hand off between devices with a single-use, expiring + token that is exchanged for a fresh session. +--%> +<%@ include file="/header.jsp" %> + +<% + String handoffUrl = request.getScheme() + "://" + request.getServerName() + + ":" + request.getServerPort() + path + + "/index.jsp;jsessionid=" + session.getId(); +%> + +

Continue on another device

+Open this link on your phone or in another browser to pick up where you left off. +You will not be asked to sign in again.

+ +Link to open on your other device:
+

+Open my session → + +<%@ include file="/footer.jsp" %> diff --git a/src/main/webapp/vulnerability/clientsecrets/integrations.jsp b/src/main/webapp/vulnerability/clientsecrets/integrations.jsp new file mode 100644 index 00000000..807f7869 --- /dev/null +++ b/src/main/webapp/vulnerability/clientsecrets/integrations.jsp @@ -0,0 +1,61 @@ +<%-- + integrations.jsp - Hard-coded secrets in front-end JavaScript + [OWASP 2025 A07 Authentication Failures, CWE-798 Use of Hard-coded Credentials; + also A04 / CWE-200 exposure of sensitive information] + + Real backend secrets (a payment SECRET key, AWS keys, an internal API key) are + hard-coded into client-side JavaScript. Everything here is shipped to the + browser, so anyone can read the keys with View Source / DevTools and call those + services directly. The UI "masks" the keys, but the raw values are in the source. + + Fix: keep secrets on the server and proxy the call; ship only publishable or + short-lived, scoped tokens to the browser. Client code can never hold a secret. +--%> +<%@ include file="/header.jsp" %> + +

Third-party Integrations

+Your account's connected services. The status widget below is rendered in your browser.

+ +
Loading integrations…
+
+ +Hint: press Ctrl+U (View Source) or open DevTools → +Sources and look at this page's script. Every key is sitting there in plain text. The +sk_live_ payment key, the AWS keys and the internal API key are +backend-only secrets and must never reach the browser, masking them in the UI +changes nothing. +

+ + + +<%@ include file="/footer.jsp" %> diff --git a/web/vulnerability/csrf/change-info.jsp b/src/main/webapp/vulnerability/csrf/change-info.jsp similarity index 95% rename from web/vulnerability/csrf/change-info.jsp rename to src/main/webapp/vulnerability/csrf/change-info.jsp index ba498527..9c27092d 100644 --- a/web/vulnerability/csrf/change-info.jsp +++ b/src/main/webapp/vulnerability/csrf/change-info.jsp @@ -6,7 +6,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% diff --git a/web/vulnerability/csrf/changepassword.jsp b/src/main/webapp/vulnerability/csrf/changepassword.jsp similarity index 96% rename from web/vulnerability/csrf/changepassword.jsp rename to src/main/webapp/vulnerability/csrf/changepassword.jsp index ba849131..ca1646fc 100644 --- a/web/vulnerability/csrf/changepassword.jsp +++ b/src/main/webapp/vulnerability/csrf/changepassword.jsp @@ -6,7 +6,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% diff --git a/src/main/webapp/vulnerability/debugmode/orders.jsp b/src/main/webapp/vulnerability/debugmode/orders.jsp new file mode 100644 index 00000000..a42d96df --- /dev/null +++ b/src/main/webapp/vulnerability/debugmode/orders.jsp @@ -0,0 +1,174 @@ +<%-- + orders.jsp - Debug mode left enabled in production + [OWASP 2025 A02 Security Misconfiguration, scenario #3, CWE-489 / CWE-215] + + An ordinary order-lookup screen. The interesting part is the top-level + exception handler at the bottom: when the application's "debug" setting is + true it renders a developer error page instead of a generic one, dumping the + configuration, the environment and the whole request back to the browser. + + That is the same switch as Django's DEBUG and Laravel's APP_DEBUG. Neither + framework is doing anything unusual; the misconfiguration is shipping the + development value to production. A researcher found 28,165 internet-facing + Django apps with DEBUG=True leaking SECRET_KEY, database passwords and API + keys, and Laravel's debug handler (Ignition) went further still: with + APP_DEBUG=true it was unauthenticated RCE, CVE-2021-3129. + + Nothing here is a separate bug. Every value on the debug page is one the + application legitimately holds. The vulnerability is only that a + configuration flag decides whether the user gets to see them. + + Fix = default debug to false, drive it from the deployment environment, and + render a generic message plus a correlation id while the detail goes to the + server log. +--%> +<%@ page buffer="32kb" %> +<%@page import="java.io.*"%> +<%@page import="java.sql.*"%> +<%@page import="java.util.*"%> +<%@page import="org.cysecurity.cspf.jvl.model.DBConnect"%> +<%@ include file="/header.jsp" %> + +<%! + static String esc(String s) { + if (s == null) return ""; + return s.replace("&", "&").replace("<", "<").replace(">", ">") + .replace("\"", """); + } + + static String row(String k, String v) { + return "" + esc(k) + "" + esc(v) + ""; + } +%> + +<% + Properties appConfig = new Properties(); + InputStream cfgIn = new FileInputStream( + getServletContext().getRealPath("/WEB-INF/config.properties")); + appConfig.load(cfgIn); + cfgIn.close(); + boolean debugMode = "true".equalsIgnoreCase(appConfig.getProperty("debug", "false")); + + String orderId = request.getParameter("orderid"); +%> + +

Order lookup

+Enter an order reference to see its status.

+ +
+ + + + + + +
Order reference:
+
+
+ +<% + if (orderId != null && orderId.trim().length() > 0) { + try { + // Deliberately strict: anything that is not a known reference blows up + // here, which is all it takes to reach the error handler below. + long ref = Long.parseLong(orderId.trim()); + + Connection con = new DBConnect().connect( + getServletContext().getRealPath("/WEB-INF/config.properties")); + Statement stmt = con.createStatement(); + ResultSet rs = stmt.executeQuery( + "select title, user from posts where postid=" + ref); + if (rs != null && rs.next()) { + out.print("Order " + ref + "
Item: " + esc(rs.getString("title")) + + "
Placed by: " + esc(rs.getString("user")) + + "
Status: shipped"); + } else { + out.print("No order found with reference " + ref + "."); + } + con.close(); + + } catch (Throwable t) { + + response.setStatus(500); + + if (!debugMode) { + // Production behaviour: say nothing useful, log everything. + long ref = System.currentTimeMillis(); + getServletContext().log("order lookup failed [ref " + ref + "]", t); +%> +
+ Sorry, something went wrong.
+ The team has been notified. Quote reference <%= ref %> if you contact support. +
+<% + } else { + // DEBUG MODE: the developer error page, shipped to whoever asked. + StringWriter sw = new StringWriter(); + t.printStackTrace(new PrintWriter(sw)); +%> +
+
+ DEBUG + <%= esc(t.getClass().getName()) %> +
<%= esc(t.getMessage()) %>
+
at <%= esc(request.getRequestURI()) %> · + debug = true · this page is only rendered because of that setting
+
+ +
Application settings WEB-INF/config.properties
+ +<% + List keys = new ArrayList(appConfig.keySet()); + Collections.sort(keys); + for (Iterator it = keys.iterator(); it.hasNext(); ) { + String k = (String) it.next(); + out.print(row(k, appConfig.getProperty(k))); + } +%> +
+ +
Server
+ +<% + out.print(row("Servlet container", application.getServerInfo())); + out.print(row("Servlet API", application.getMajorVersion() + "." + application.getMinorVersion())); + out.print(row("java.version", System.getProperty("java.version"))); + out.print(row("java.vendor", System.getProperty("java.vendor"))); + out.print(row("os.name", System.getProperty("os.name") + " " + System.getProperty("os.version"))); + out.print(row("user.name", System.getProperty("user.name"))); + out.print(row("catalina.base", System.getProperty("catalina.base"))); + out.print(row("Document root", getServletContext().getRealPath("/"))); +%> +
+ +
Request
+ +<% + out.print(row("Remote address", request.getRemoteAddr())); + for (Enumeration e = request.getHeaderNames(); e.hasMoreElements(); ) { + String h = (String) e.nextElement(); + out.print(row("header: " + h, request.getHeader(h))); + } + Cookie[] cookies = request.getCookies(); + if (cookies != null) { + for (int i = 0; i < cookies.length; i++) { + out.print(row("cookie: " + cookies[i].getName(), cookies[i].getValue())); + } + } + for (Enumeration e = session.getAttributeNames(); e.hasMoreElements(); ) { + String a = (String) e.nextElement(); + out.print(row("session: " + a, String.valueOf(session.getAttribute(a)))); + } +%> +
+ +
Stack trace
+ 
<%= esc(sw.toString()) %>
+
+<% + } + } + } +%> + +<%@ include file="/footer.jsp" %> diff --git a/src/main/webapp/vulnerability/deserialize/preferences.jsp b/src/main/webapp/vulnerability/deserialize/preferences.jsp new file mode 100644 index 00000000..57f0b727 --- /dev/null +++ b/src/main/webapp/vulnerability/deserialize/preferences.jsp @@ -0,0 +1,157 @@ +<%-- + preferences.jsp - Insecure Java deserialization + [OWASP 2025 A08 Software or Data Integrity Failures, CWE-502] + + A normal-looking settings screen. The user's preferences are carried between + requests as a serialized Java object, base64 encoded into a hidden "view + state" field, exactly the way JSF (javax.faces.ViewState) and ASP.NET + (__VIEWSTATE) carry page state: the server keeps nothing between requests, + the client hands the state back on every post. + + On the way back in, that blob is deserialized with a RAW ObjectInputStream + that will instantiate ANY class on the classpath (no resolveClass allow-list + and no signature over the bytes). commons-collections 3.1 is on the + classpath, so an attacker can replace the view state with a ysoserial + CommonsCollections6 gadget and run commands on the server. + + Two things are missing, and both are A08: + 1. the state is not integrity-protected (ASP.NET signs __VIEWSTATE with a + MAC for exactly this reason), + 2. the format itself executes code while being read. + + Fix = never deserialize untrusted data. Carry the state as JSON with a fixed + schema, or keep it server-side behind an opaque id. If native serialization + is unavoidable, sign the bytes and apply a strict allow-list in + resolveClass(). +--%> +<%@page import="java.io.*"%> +<%@page import="javax.xml.bind.DatatypeConverter"%> +<%@page import="org.cysecurity.cspf.jvl.model.Preferences"%> +<%@ include file="/header.jsp" %> + +<%! + static String sel(Object current, String value) { + return String.valueOf(current).equals(value) ? " selected=\"selected\"" : ""; + } +%> + +<% + // ---- the view state arrives here ------------------------------------- + byte[] data = null; + String state = request.getParameter("state"); + String ctype = request.getContentType(); + + if (state != null && state.trim().length() > 0) { + data = DatatypeConverter.parseBase64Binary(state.trim()); + } else if (ctype != null && ctype.toLowerCase().startsWith("application/octet-stream")) { + // Raw serialized object in the request body: how a ysoserial payload arrives. + ByteArrayOutputStream buf = new ByteArrayOutputStream(); + InputStream in = request.getInputStream(); + byte[] chunk = new byte[4096]; + int n; + while ((n = in.read(chunk)) != -1) { + buf.write(chunk, 0, n); + } + data = buf.toByteArray(); + } + + Preferences prefs = null; + String serverNote = null; + + if (data != null && data.length > 0) { + // VULNERABLE (CWE-502): attacker-controlled bytes are deserialized with + // no signature check and no class allow-list, so a gadget chain executes + // during readObject(). + ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data)); + Object obj = ois.readObject(); + ois.close(); + + if (obj instanceof Preferences) { + prefs = (Preferences) obj; + serverNote = "Preferences restored: theme=" + prefs.getTheme() + + ", language=" + prefs.getLanguage() + + ", itemsPerPage=" + prefs.getItemsPerPage(); + } else { + serverNote = "Restored object of type " + obj.getClass().getName() + ""; + } + } + + if (prefs == null) { + prefs = new Preferences(); + } + + // ---- the form edits the restored object ------------------------------ + boolean saved = false; + if (request.getParameter("save") != null) { + if (request.getParameter("theme") != null) { + prefs.setTheme(request.getParameter("theme")); + } + if (request.getParameter("language") != null) { + prefs.setLanguage(request.getParameter("language")); + } + try { + prefs.setItemsPerPage(Integer.parseInt(request.getParameter("itemsPerPage"))); + } catch (Exception ignored) { + // keep whatever the restored object had + } + saved = true; + } + + // ---- and goes back out as the next view state ------------------------ + ByteArrayOutputStream bos = new ByteArrayOutputStream(); + ObjectOutputStream oos = new ObjectOutputStream(bos); + oos.writeObject(prefs); + oos.close(); + String viewState = DatatypeConverter.printBase64Binary(bos.toByteArray()); +%> + +

Display settings

+<% if (saved) { %> + Your settings have been saved.
+<% } %> +<% if (serverNote != null) { %> + <%= serverNote %>
+<% } %> +<% if (saved || serverNote != null) { %>
<% } %> + +
+ + + + + + + + + + + + + + +
Theme: + +
Language: + +
Items per page: + +
+ +
+ + + +<%@ include file="/footer.jsp" %> diff --git a/src/main/webapp/vulnerability/failopen/report.jsp b/src/main/webapp/vulnerability/failopen/report.jsp new file mode 100644 index 00000000..058d9e01 --- /dev/null +++ b/src/main/webapp/vulnerability/failopen/report.jsp @@ -0,0 +1,47 @@ +<%! + // Per-document access tokens. Server-side secret; the client never sees these. + private static final java.util.Map DOC_TOKENS = new java.util.HashMap(); + static { DOC_TOKENS.put("42", "a91f7c3e5d20b846"); } + private static String tokenFor(String doc) { return DOC_TOKENS.get(doc); } +%> +<%@ include file="/header.jsp" %> +

Restricted: Employee Payroll Register

+

Each document opens with a per-document access key: ?doc=<id>&key=<token>. HR holds the signed links; the tokens are secret.

+<% + String doc = request.getParameter("doc"); + String key = request.getParameter("key"); + if (doc == null) { +%> +

Q3 Payroll Register  ·  Download report

+ <%@ include file="/footer.jsp" %> +<% + return; + } + try { + // Block anyone without this document's access token. + if (!key.equals(tokenFor(doc))) { // NPE thrown here when 'key' is absent (null) +%> +

Access denied: a valid access key is required for this document.

+ <%@ include file="/footer.jsp" %> +<% + return; + } + } catch (Exception e) { + // VULNERABLE (A10 Mishandling of Exceptional Conditions - CWE-636): + // a missing key makes the check throw, the exception is swallowed, and + // execution falls through to the protected report below -> FAIL OPEN. + } +%> +
+

Payroll Register — RESTRICTED (HR / Finance)

+ + + + + + + + +
EmployeeDeptAnnual salary
J. Rivera (CEO)Executive$640,000
A. ChenEngineering$152,000
B. KumarSales$98,500
C. OkoyeFinance$141,000
+
+<%@ include file="/footer.jsp" %> diff --git a/web/vulnerability/forum.jsp b/src/main/webapp/vulnerability/forum.jsp similarity index 98% rename from web/vulnerability/forum.jsp rename to src/main/webapp/vulnerability/forum.jsp index 8632f5b3..f291fe93 100644 --- a/web/vulnerability/forum.jsp +++ b/src/main/webapp/vulnerability/forum.jsp @@ -11,7 +11,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page contentType="text/html" pageEncoding="UTF-8"%> @@ -24,7 +24,6 @@ out.print("Hello "+session.getAttribute("user")+", Welcome to Our Forum !"); } %> -

Create Post:

Title :
diff --git a/web/vulnerability/forumUsersList.jsp b/src/main/webapp/vulnerability/forumUsersList.jsp similarity index 93% rename from web/vulnerability/forumUsersList.jsp rename to src/main/webapp/vulnerability/forumUsersList.jsp index e05fc621..595e98d6 100644 --- a/web/vulnerability/forumUsersList.jsp +++ b/src/main/webapp/vulnerability/forumUsersList.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties")); String username=request.getParameter("username"); diff --git a/web/vulnerability/forumposts.jsp b/src/main/webapp/vulnerability/forumposts.jsp similarity index 94% rename from web/vulnerability/forumposts.jsp rename to src/main/webapp/vulnerability/forumposts.jsp index e442e02a..e2c7096d 100644 --- a/web/vulnerability/forumposts.jsp +++ b/src/main/webapp/vulnerability/forumposts.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties")); diff --git a/web/vulnerability/idor/change-email.jsp b/src/main/webapp/vulnerability/idor/change-email.jsp similarity index 95% rename from web/vulnerability/idor/change-email.jsp rename to src/main/webapp/vulnerability/idor/change-email.jsp index 8ab67b12..0dd3c345 100644 --- a/web/vulnerability/idor/change-email.jsp +++ b/src/main/webapp/vulnerability/idor/change-email.jsp @@ -6,7 +6,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% diff --git a/web/vulnerability/idor/download.jsp b/src/main/webapp/vulnerability/idor/download.jsp similarity index 100% rename from web/vulnerability/idor/download.jsp rename to src/main/webapp/vulnerability/idor/download.jsp diff --git a/src/main/webapp/vulnerability/integrity/checkout.jsp b/src/main/webapp/vulnerability/integrity/checkout.jsp new file mode 100644 index 00000000..d4a41995 --- /dev/null +++ b/src/main/webapp/vulnerability/integrity/checkout.jsp @@ -0,0 +1,84 @@ +<%-- + checkout.jsp - Inclusion of Web Functionality from an Untrusted Source + [OWASP 2025 A08 Software or Data Integrity Failures, scenario #1; + CWE-830 Inclusion of Web Functionality from an Untrusted Source] + + The page loads a "promo widget" from a third-party host with a plain + + +<%@ include file="/footer.jsp" %> diff --git a/src/main/webapp/vulnerability/otp/verify-otp.jsp b/src/main/webapp/vulnerability/otp/verify-otp.jsp new file mode 100644 index 00000000..55dca777 --- /dev/null +++ b/src/main/webapp/vulnerability/otp/verify-otp.jsp @@ -0,0 +1,82 @@ +<%-- + verify-otp.jsp - validates the one-time code + [OWASP 2025 A06 Insecure Design, CWE-602 / CWE-302] + + This endpoint is not the vulnerability either. It is a competent + implementation: constant-time comparison, a 120-second lifetime, single use, + and a hard cap of five attempts before the code is destroyed. Brute forcing + it is not practical. + + The flaw is the last line. On success the result is returned to the browser + and nothing is recorded on the server, so the outcome of the security check + lives only in the client's hands from here on. See confirm.jsp. +--%><%@page import="java.util.Date"%><%! + static final long OTP_LIFETIME_MS = 120000L; + static final int OTP_MAX_ATTEMPTS = 5; + + static boolean constantTimeEquals(String a, String b) { + if (a == null || b == null || a.length() != b.length()) return false; + int diff = 0; + for (int i = 0; i < a.length(); i++) { + diff |= a.charAt(i) ^ b.charAt(i); + } + return diff == 0; + } + + static void clearOtp(javax.servlet.http.HttpSession s) { + s.removeAttribute("otpCode"); + s.removeAttribute("otpIssuedAt"); + s.removeAttribute("otpAttempts"); + } +%><% + response.setContentType("application/json"); + response.setHeader("Cache-Control", "no-store"); + + if (!"1".equals(session.getAttribute("isLoggedIn"))) { + out.print("{\"verified\":false,\"error\":\"Your session has expired. Sign in again.\"}"); + return; + } + + String submitted = request.getParameter("otp"); + String expected = (String) session.getAttribute("otpCode"); + Long issuedAt = (Long) session.getAttribute("otpIssuedAt"); + Integer attempts = (Integer) session.getAttribute("otpAttempts"); + + if (expected == null || issuedAt == null || attempts == null) { + out.print("{\"verified\":false,\"error\":\"Request a code first.\"}"); + return; + } + + if (System.currentTimeMillis() - issuedAt.longValue() > OTP_LIFETIME_MS) { + clearOtp(session); + out.print("{\"verified\":false,\"error\":\"That code has expired. Request a new one.\"}"); + return; + } + + if (attempts.intValue() >= OTP_MAX_ATTEMPTS) { + clearOtp(session); + out.print("{\"verified\":false,\"error\":\"Too many attempts. Request a new code.\"}"); + return; + } + + if (!constantTimeEquals(expected, submitted == null ? "" : submitted.trim())) { + int used = attempts.intValue() + 1; + session.setAttribute("otpAttempts", new Integer(used)); + int left = OTP_MAX_ATTEMPTS - used; + if (left <= 0) { + clearOtp(session); + out.print("{\"verified\":false,\"error\":\"Too many attempts. Request a new code.\"}"); + } else { + out.print("{\"verified\":false,\"error\":\"Incorrect code. " + left + + (left == 1 ? " attempt" : " attempts") + " left.\"}"); + } + return; + } + + // Correct code. Single use, so it cannot be replayed. + clearOtp(session); + + // ...and that is the whole problem: the verdict is handed to the browser and + // never written to the session, so confirm.jsp has nothing to consult. + out.print("{\"verified\":true}"); +%> diff --git a/web/vulnerability/sde/hash.jsp b/src/main/webapp/vulnerability/sde/hash.jsp similarity index 100% rename from web/vulnerability/sde/hash.jsp rename to src/main/webapp/vulnerability/sde/hash.jsp diff --git a/web/vulnerability/securitymisconfig/pages.jsp b/src/main/webapp/vulnerability/securitymisconfig/pages.jsp similarity index 76% rename from web/vulnerability/securitymisconfig/pages.jsp rename to src/main/webapp/vulnerability/securitymisconfig/pages.jsp index 4393fc73..b8d5605a 100644 --- a/web/vulnerability/securitymisconfig/pages.jsp +++ b/src/main/webapp/vulnerability/securitymisconfig/pages.jsp @@ -1,9 +1,14 @@ +<%-- The shared header alone exceeds the 8kb default JSP buffer. Without a bigger + buffer the response is committed before Integer.parseInt() throws, so Tomcat + cannot replace it with the error page and the browser just shows a truncated + page instead of the stack trace this demo is about. --%> +<%@ page buffer="32kb" %> <%@page import="java.sql.SQLException"%> <%@page import="java.sql.ResultSet"%> <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% try { diff --git a/web/vulnerability/sqli/download.jsp b/src/main/webapp/vulnerability/sqli/download.jsp similarity index 100% rename from web/vulnerability/sqli/download.jsp rename to src/main/webapp/vulnerability/sqli/download.jsp diff --git a/web/vulnerability/sqli/download_id.jsp b/src/main/webapp/vulnerability/sqli/download_id.jsp similarity index 97% rename from web/vulnerability/sqli/download_id.jsp rename to src/main/webapp/vulnerability/sqli/download_id.jsp index 5949e76a..f0d5d247 100644 --- a/web/vulnerability/sqli/download_id.jsp +++ b/src/main/webapp/vulnerability/sqli/download_id.jsp @@ -7,7 +7,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page import="java.io.File"%> diff --git a/web/vulnerability/sqli/download_id_union.jsp b/src/main/webapp/vulnerability/sqli/download_id_union.jsp similarity index 97% rename from web/vulnerability/sqli/download_id_union.jsp rename to src/main/webapp/vulnerability/sqli/download_id_union.jsp index 750ab15e..9cbbdc2f 100644 --- a/web/vulnerability/sqli/download_id_union.jsp +++ b/src/main/webapp/vulnerability/sqli/download_id_union.jsp @@ -7,7 +7,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page import="java.io.File"%> diff --git a/web/vulnerability/sqli/union2.jsp b/src/main/webapp/vulnerability/sqli/union2.jsp similarity index 100% rename from web/vulnerability/sqli/union2.jsp rename to src/main/webapp/vulnerability/sqli/union2.jsp diff --git a/src/main/webapp/vulnerability/ssrf/URLPreview.jsp b/src/main/webapp/vulnerability/ssrf/URLPreview.jsp new file mode 100644 index 00000000..06b31162 --- /dev/null +++ b/src/main/webapp/vulnerability/ssrf/URLPreview.jsp @@ -0,0 +1,74 @@ +<%-- + URLPreview.jsp - Server-Side Request Forgery (SSRF) demo [OWASP 2025 A01, CWE-918] + + A "URL preview" feature: the SERVER fetches whatever URL the user submits and + shows the response. There is NO validation of the scheme, host, or resolved + address, so an attacker can make the server reach resources the browser cannot: + internal services, the cloud metadata IP, or local files via file://. + + Java 1.7 compatible: java.net.URL / URLConnection, BufferedReader, explicit close. +--%> +<%@ include file="/header.jsp" %> +<%@ page import="java.net.URL" %> +<%@ page import="java.net.URLConnection" %> +<%@ page import="java.io.InputStream" %> +<%@ page import="java.io.InputStreamReader" %> +<%@ page import="java.io.BufferedReader" %> + +URL Preview
+Enter a URL and the server will fetch it for you and show the response.

+ + + URL: + +
+
+Hint: the server fetches this, not your browser. Try +file:///etc/passwd, an internal host like http://mysql:3306/, +or the cloud metadata IP http://169.254.169.254/latest/meta-data/. +

+ +<% + String target = request.getParameter("url"); + if (target != null && !target.trim().equals("")) { + InputStream in = null; + BufferedReader br = null; + try { + // VULNERABLE: no scheme / host / address check. The server will open + // a connection to any URL the client supplies. This is SSRF. + URL u = new URL(target); + URLConnection conn = u.openConnection(); + conn.setConnectTimeout(5000); + conn.setReadTimeout(5000); + + in = conn.getInputStream(); + br = new BufferedReader(new InputStreamReader(in)); + + StringBuffer sb = new StringBuffer(); + String line; + int limit = 20000; + while ((line = br.readLine()) != null && sb.length() < limit) { + sb.append(line).append("\n"); + } + + // Show the fetched body as text (escaped), not rendered as HTML. + String body = sb.toString() + .replace("&", "&").replace("<", "<").replace(">", ">"); + String shown = target.replace("&", "&").replace("<", "<").replace(">", ">"); + + out.print("Server fetched: " + shown + ""); + out.print("
" + body + "
"); + } catch (Exception e) { + String msg = String.valueOf(e.getMessage()) + .replace("&", "&").replace("<", "<").replace(">", ">"); + out.print("Could not fetch: " + msg + ""); + } finally { + try { if (br != null) { br.close(); } } catch (Exception ignore) {} + try { if (in != null) { in.close(); } } catch (Exception ignore) {} + } + } +%> + +<%@ include file="/footer.jsp" %> diff --git a/src/main/webapp/vulnerability/transfer/index.jsp b/src/main/webapp/vulnerability/transfer/index.jsp new file mode 100644 index 00000000..b0d7c11b --- /dev/null +++ b/src/main/webapp/vulnerability/transfer/index.jsp @@ -0,0 +1,45 @@ +<%@page import="java.sql.*"%> +<%@page import="org.cysecurity.cspf.jvl.model.DBConnect"%> +<%@ include file="/header.jsp" %> +

Wallet: Transfer Funds

+<% + String me = (String) session.getAttribute("user"); + if (me == null) { +%> +

Please log in to use your wallet.

+<% + } else { +%> +

Signed in as <%= me.replace("<", "<") %>. Move funds from your account to another user.

+
+ To user + amount + + +
+<% + } +%> +

Account balances

+ + +<% + Connection con = new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties")); + long total = 0; + if (con != null && !con.isClosed()) { + Statement st = con.createStatement(); + ResultSet rs = st.executeQuery("SELECT username, balance FROM users ORDER BY balance DESC"); + while (rs.next()) { + String u = rs.getString("username"); + long b = rs.getLong("balance"); + total += b; +%> + +<% + } + con.close(); + } +%> + +
AccountBalance
<%= u == null ? "" : u.replace("<", "<") %><%= b %>
TOTAL in system<%= total %>
+<%@ include file="/footer.jsp" %> diff --git a/web/vulnerability/unvalidated/OpenForward.jsp b/src/main/webapp/vulnerability/unvalidated/OpenForward.jsp similarity index 100% rename from web/vulnerability/unvalidated/OpenForward.jsp rename to src/main/webapp/vulnerability/unvalidated/OpenForward.jsp diff --git a/web/vulnerability/unvalidated/OpenURL.jsp b/src/main/webapp/vulnerability/unvalidated/OpenURL.jsp similarity index 86% rename from web/vulnerability/unvalidated/OpenURL.jsp rename to src/main/webapp/vulnerability/unvalidated/OpenURL.jsp index ccc824e8..3d6d0045 100644 --- a/web/vulnerability/unvalidated/OpenURL.jsp +++ b/src/main/webapp/vulnerability/unvalidated/OpenURL.jsp @@ -1,4 +1,4 @@ <%@ include file="/header.jsp" %> Cyber Security & Privacy Foundation has always been committed in providing the public with knowledge on how to defend themselves from malicious elements on the internet. Hence, we have started a new Certification Program that checks the security and quality of websites and security products. -

Click Here to know more >> +

Click Here to know more >> <%@ include file="/footer.jsp" %> \ No newline at end of file diff --git a/src/main/webapp/vulnerability/upload/avatar.jsp b/src/main/webapp/vulnerability/upload/avatar.jsp new file mode 100644 index 00000000..30d91918 --- /dev/null +++ b/src/main/webapp/vulnerability/upload/avatar.jsp @@ -0,0 +1,24 @@ +<%@ include file="/header.jsp" %> +

Profile Picture

+

Upload a new profile picture.

+<% + if (session.getAttribute("isLoggedIn") == null) { +%> + x Please log in first. +<% + } else { +%> +
+ + + +
Choose image:
+
+<% + Object m = request.getAttribute("uploadMessage"); + if (m != null) { + out.print("

" + m + "

"); + } + } +%> +<%@ include file="/footer.jsp" %> diff --git a/web/vulnerability/xss/flash/exss.jsp b/src/main/webapp/vulnerability/xss/flash/exss.jsp similarity index 100% rename from web/vulnerability/xss/flash/exss.jsp rename to src/main/webapp/vulnerability/xss/flash/exss.jsp diff --git a/web/vulnerability/xss/flash/xss1.swf b/src/main/webapp/vulnerability/xss/flash/xss1.swf similarity index 100% rename from web/vulnerability/xss/flash/xss1.swf rename to src/main/webapp/vulnerability/xss/flash/xss1.swf diff --git a/web/vulnerability/xss/flash/xss2.swf b/src/main/webapp/vulnerability/xss/flash/xss2.swf similarity index 100% rename from web/vulnerability/xss/flash/xss2.swf rename to src/main/webapp/vulnerability/xss/flash/xss2.swf diff --git a/web/vulnerability/xss/search.jsp b/src/main/webapp/vulnerability/xss/search.jsp similarity index 100% rename from web/vulnerability/xss/search.jsp rename to src/main/webapp/vulnerability/xss/search.jsp diff --git a/web/vulnerability/xss/xss4.jsp b/src/main/webapp/vulnerability/xss/xss4.jsp similarity index 100% rename from web/vulnerability/xss/xss4.jsp rename to src/main/webapp/vulnerability/xss/xss4.jsp diff --git a/src/main/webapp/vulnerability/xss/xss5.jsp b/src/main/webapp/vulnerability/xss/xss5.jsp new file mode 100644 index 00000000..de9b98ca --- /dev/null +++ b/src/main/webapp/vulnerability/xss/xss5.jsp @@ -0,0 +1,16 @@ +<%@ page import="java.net.URLDecoder" %> +<%@ include file="/header.jsp" %> +<% + String fullURL = request.getRequestURI(); + String qs = request.getQueryString(); + if (qs != null) { + try { qs = URLDecoder.decode(qs, "UTF-8"); } catch (Exception e) {} + fullURL += "?" + qs; + } +%> +

Latest Updates

+

Stay informed about the latest changes and announcements on our site.

+
+Share this page: permalink +

+<%@ include file="/footer.jsp" %> diff --git a/web/META-INF/context.xml b/web/META-INF/context.xml deleted file mode 100644 index 6f508867..00000000 --- a/web/META-INF/context.xml +++ /dev/null @@ -1,2 +0,0 @@ - - diff --git a/web/WEB-INF/config.properties b/web/WEB-INF/config.properties deleted file mode 100644 index 452aa0b8..00000000 --- a/web/WEB-INF/config.properties +++ /dev/null @@ -1,10 +0,0 @@ -# To change this license header, choose License Headers in Project Properties. -# To change this template file, choose Tools | Templates -# and open the template in the editor. - -dbuser=root -dbpass=root -dbname=abc -dburl=jdbc:mysql://localhost:3306/ -jdbcdriver=com.mysql.jdbc.Driver -siteTitle=Java Vulnerable Lab \ No newline at end of file diff --git a/web/WEB-INF/web.xml b/web/WEB-INF/web.xml deleted file mode 100644 index d208798c..00000000 --- a/web/WEB-INF/web.xml +++ /dev/null @@ -1,99 +0,0 @@ - - - - install - controller.install - - - loginValidator - controller.LoginValidator - - - Register - controller.Register - - - Logout - controller.Logout - - - open - controller.open - - - SendMessage - controller.SendMessage - - - ForwardMe - controller.ForwardMe - - - AddPage - controller.AddPage - - - UsernameCheck - controller.UsernameCheck - - - EmailCheck - controller.EmailCheck - - - XPathQuery - controller.XPathQuery - - - xxe - controller.xxe - - - install - /install - - - loginValidator - /LoginValidator - - - Register - /AddUser - - - Logout - /Logout - - - open - /open - - - SendMessage - /SendMessage.do - - - ForwardMe - /ForwardMe - - - AddPage - /admin/AddPage.do - - - UsernameCheck - /UsernameCheck.do - - - EmailCheck - /EmailCheck.do - - - XPathQuery - /XPathQuery.do - - - xxe - /vulnerability/Injection/xxe.do - - diff --git a/web/header.jsp b/web/header.jsp deleted file mode 100644 index 88afd3f6..00000000 --- a/web/header.jsp +++ /dev/null @@ -1,169 +0,0 @@ - <%@page import="java.io.FileInputStream"%> -<%@page import="java.util.Properties"%> -<%@page import="java.io.File"%> -<% - String path = request.getContextPath(); - String configPath=getServletContext().getRealPath("/WEB-INF/config.properties"); - - Properties properties=new Properties(); - properties.load(new FileInputStream(configPath)); - String siteTitle=properties.getProperty("siteTitle"); - %> - - - - - <%=siteTitle%> - - <% out.print(""); %> - - - -
- - - -
-
- -
- - -
- \ No newline at end of file diff --git a/web/style.css b/web/style.css deleted file mode 100644 index 0df7b839..00000000 --- a/web/style.css +++ /dev/null @@ -1,224 +0,0 @@ -* { - margin: 0px; - padding: 0px; -} -body { - padding-top: 0px; - background:url("images/bg.png") #000; - color: #FFF; - font-family: verdana, arial, sans-serif; - - text-align: left; - letter-spacing: 1px; -} -a {color: #A92332;font-size: 14px;text-decoration:none;} -a:hover {color: #01a9c0;} -.more{float: right; font-size: 11px; color: #add8f9; font-weight: bold; text-decoration: none;} -.clear{clear:both;} -p{ margin: 20px 0px 20px 0px;line-height: 16px;font-size: 14px;} -#container { - margin-left: auto ; - margin-right: auto ; - width:873px; -} -.success -{ - color:green; -} -.fail -{ - color:red; -} -#Main-Container{ - width:750px; - border-radius: 15px; - -webkit-border-radius: 15px; - -moz-border-radius: 15px; - box-shadow: 3px 3px 4px #000; - -webkit-box-shadow: 2px 2px 3px #000; - -moz-box-shadow: 2px 2px 3px #000; - - border: solid 4px #FFF; - margin-left: auto ; - margin-right: auto ; -} -#logo { -width:500px; - - text-align:center; - margin-left: auto ; - margin-right: auto ; -} - -#Main{ - width:650px; - height: 500px; - margin-left: auto ; - margin-right: auto ; -} -#Main h2{ - color: #d4e5f2; - font-family: Arial; - font-size: 18px; - padding: 0 0 10px 5px; -} - -#left { - float:left; - width:435px; - margin: 0px 0px 0px 85px; - display:inline; -} -#right { - float:right; - width:258px; - height:auto; - margin: 0px 62px 20px 0px; - display:inline; -} -#right a img{ - margin: 8px 8px 8px 0px; - border: none 0px #FFFFFF; -} -#menu-bar { -width:680px; - margin: 0px 0px 0px 0px; - padding: 6px 6px 0px 6px; - height: 34px; - line-height: 100%; - border-radius: 15px 15px 0px 0px; - -webkit-border-radius: 24px; - -moz-border-radius: 24px; - box-shadow: 2px 2px 3px #666666; - -webkit-box-shadow: 2px 2px 3px #666666; - -moz-box-shadow: 2px 2px 3px #666666; - background: #000000; - border: solid 4px #FFF; - border-bottom:none; -} -#menu-bar li { - margin: 0 2px; - padding: 0 0 2px; - float: left; - position: relative; - list-style: none; -} -#menu-bar a { - font-weight: bold; - font-family: arial; - font-style: normal; - font-size: 12px; - color: #E7E5E5; - text-decoration: none; - display: block; - padding: 8px 15px; - margin: 0; - border-radius: 10px; - -webkit-border-radius: 10px; - -moz-border-radius: 10px; - text-shadow: 2px 2px 3px #000000; -} -#menu-bar .current a, #menu-bar li:hover > a { - background: #027BAB; - filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=#10D5EB, endColorstr=#0883FF); - background: -webkit-gradient(linear, left top, left bottom, from(#10D5EB), to(#0883FF)); - background: -moz-linear-gradient(top, #10D5EB, #0883FF); - color: #000000; - -webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .2); - -moz-box-shadow: 0 1px 1px rgba(0, 0, 0, .2); - box-shadow: 0 1px 1px rgba(0, 0, 0, .2); - text-shadow: 2px 2px 3px #FFFFFF; -} -#menu-bar ul li:hover a, #menu-bar li:hover li a { - background: none; - border: none; - color: #666; - -box-shadow: none; - -webkit-box-shadow: none; - -moz-box-shadow: none; -} -#menu-bar ul a:hover { - background: #0399D4 !important; - filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=#10D5EB, endColorstr=#0883FF); - background: -webkit-gradient(linear, left top, left bottom, from(#10D5EB), to(#0883FF)) !important; - background: -moz-linear-gradient(top, #10D5EB, #0883FF) !important; - color: #000000 !important; - border-radius: 0; - -webkit-border-radius: 0; - -moz-border-radius: 0; - text-shadow: 2px 2px 3px #FFFFFF; -} -#menu-bar ul { - background: #DDDDDD; - filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=#FFFFFF, endColorstr=#CFCFCF); - background: -webkit-gradient(linear, left top, left bottom, from(#FFFFFF), to(#CFCFCF)); - background: -moz-linear-gradient(top, #FFFFFF, #CFCFCF); - display: none; - margin: 0; - padding: 0; - width: 250px; - position: absolute; - top: 30px; - left: 0; - border: solid 1px #B4B4B4; - border-radius: 10px; - -webkit-border-radius: 10px; - -moz-border-radius: 10px; - -webkit-box-shadow: 2px 2px 3px #222222; - -moz-box-shadow: 2px 2px 3px #222222; - box-shadow: 2px 2px 3px #222222; -} -#menu-bar li:hover > ul { - display: block; -} -#menu-bar ul li { - float: none; - margin: 0; - padding: 0; -} -#menu-bar ul a { - padding:5px 0 5px 8px; - color:#424242 !important; - font-size:12px; - font-style:normal; - font-family:arial; - font-weight: normal; - text-shadow: 2px 2px 3px #FFFFFF; -} -#menu-bar ul li:first-child > a { - border-top-left-radius: 10px; - -webkit-border-top-left-radius: 10px; - -moz-border-radius-topleft: 10px; - border-top-right-radius: 10px; - -webkit-border-top-right-radius: 10px; - -moz-border-radius-topright: 10px; -} -#menu-bar ul li:last-child > a { - border-bottom-left-radius: 10px; - -webkit-border-bottom-left-radius: 10px; - -moz-border-radius-bottomleft: 10px; - border-bottom-right-radius: 10px; - -webkit-border-bottom-right-radius: 10px; - -moz-border-radius-bottomright: 10px; -} -#menu-bar:after { - content: "."; - display: block; - clear: both; - visibility: hidden; - line-height: 0; - height: 0; -} -#menu-bar { - display: inline-block; -} - html[xmlns] #menu-bar { - display: block; -} -* html #menu-bar { - height: 1%; -} -#menu-bar ul li ul { - left: 100%; top:0; - background:#FFf; -} diff --git a/web/vulnerability/Injection/xslt.jsp b/web/vulnerability/Injection/xslt.jsp deleted file mode 100644 index f2582ebe..00000000 --- a/web/vulnerability/Injection/xslt.jsp +++ /dev/null @@ -1,17 +0,0 @@ - -<%@ include file="/header.jsp" %> -<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %> -<%@ taglib prefix="x" uri="http://java.sun.com/jsp/jstl/xml" %> -
- Select Style: - -

- - - - - - <%@ include file="/footer.jsp" %> \ No newline at end of file diff --git a/web/vulnerability/Injection/xxe.jsp b/web/vulnerability/Injection/xxe.jsp deleted file mode 100644 index 2419a47a..00000000 --- a/web/vulnerability/Injection/xxe.jsp +++ /dev/null @@ -1,26 +0,0 @@ - -<%@ include file="/header.jsp" %> - - -
-
- <%@ include file="/footer.jsp" %> \ No newline at end of file diff --git a/web/vulnerability/baasm/URLRewriting.jsp b/web/vulnerability/baasm/URLRewriting.jsp deleted file mode 100644 index bb98b237..00000000 --- a/web/vulnerability/baasm/URLRewriting.jsp +++ /dev/null @@ -1,9 +0,0 @@ - <%@ include file="/header.jsp" %> - - <% - out.print("Your Session ID:"+session.getId()); - %> -
-
- X Never Expose Session IDs in URL. X
- <%@ include file="/footer.jsp" %> \ No newline at end of file