You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
JavaSecLab is **the most comprehensive Java vulnerability platform **, providing related vulnerability defect code, repair code, vulnerability scenarios, audit SINK point, security coding specifications, vulnerability traffic analysis, covering a variety of vulnerability scenarios, user-friendly interaction UI......
17
19
18
20
19
21
20
22
21
23
22
-
## 面向人群
24
+
## public-facing
23
25
24
-
-安全服务方面：帮助安全服务人员理解漏洞原理(产生、修复、审计)，以及对应漏洞流量分析
26
+
-Security services: Help security service personnel understand the principle of vulnerability (generation, repair, audit), and corresponding vulnerability traffic analysis
25
27
26
-
-甲方安全方面：可作为开发安全培训演示，友好的交互方式，帮助研发同学更容易理解漏洞
28
+
-Party A's security: It can be used as a development security training demonstration, a friendly interactive way to help R & D students more easily understand the vulnerability
27
29
28
-
-安全研究方面：各种漏洞的不同触发场景，可用于xAST等安全工具测试
30
+
-Security research: Different trigger scenarios for various vulnerabilities can be used for testing security tools such as xAST
**I have worked in Party A's unit for a period of time, and had access to the complete vulnerability life cycle ** : After completing penetration tests many times, I sent work orders (TAPD, Jira) to notify the R&D students to fix the vulnerability, and I often faced some problems: **1, the R&D did not know why this was a vulnerability? 2, R&D does not know how to fix this vulnerability? **
53
+
Thus, an idea 💡 arises spontaneously, and I happen to know some development knowledge, wondering whether I can let the R & D students quickly understand the generation and repair of loopholes through the way of code...
> The platform provides security coding specifications for relevant vulnerabilities, and Party A friends can consider joining the development of security training when doing SDL/DevSecOps construction
In addition, I have also done security service projects, I think most of my friends will be with me, just according to the information collection -> network -> Discovery of vulnerabilities -> output report this process test, for how the vulnerability is generated, how to repair, it seems not concerned...
In the process of code audit, it is common to locate the SINK point (that is, the key location of code execution or output) and then backtrack to find the corresponding SOURCE point (that is, the location of the input or data source). The code audit is done by concatenating the SOURCE and SINK points
> For each vulnerability, the platform provides the corresponding defect code and various security repair methods (such as: 1, upgrade repair 2, non-upgrade repair). At the same time, for code audit, the platform also provides the SINK point of related vulnerabilities
Later, contact with application security products, SCA, SAST, DAST, RASP, etc., looking at security vulnerabilities seems to be another Angle, for customers, the purchase of security tools, whether it is scanning source code, containers, images... Of course, I also hope to less false positives, the author has more or less access to accessibility analysis and other related technologies, the project has also written different trigger scenarios for each vulnerability, interested friends can test it...
62
64
63
-
> 平台针对同种漏洞提供多种触发场景
65
+
> The platform provides multiple trigger scenarios for the same vulnerability
🆕 update the vulnerability traffic analysis module to facilitate teachers' reference and learning. Take the vulnerability traffic of this project as an example. If you have better vulnerability traffic packets, welcome to submit PR to participate in the project 🌹
66
68
67
69
68
70
69
-
这里以延时注入为例：可以从响应时间明显的看到其流量特征：5秒后服务器响应
71
+
Here, take delayed injection as an example: the traffic characteristic can be clearly seen from the response time: the server responds after 5 seconds
Modify the configuration file application.yml active to dev(the project default is docker if there is a database connection error during the construction process, teachers can pay attention to here)
96
98
97
99
```yaml
98
100
spring:
99
-
#环境 dev|docker
101
+
#Environment dev|docker
100
102
profiles:
101
103
active: dev
102
104
```
103
105
104
-
2. 修改application-dev.yml配置文件
106
+
2. Modify the application-dev.yml configuration file
For details about deployment solutions and deployment questions, see：[Deployment guide](https://github.com/whgojp/JavaSecLab/wiki/%E9%83%A8%E7%BD%B2%E6%8C%87%E5%8D%97)
132
134
133
-
## 开源协议
135
+
## Open source protocol
134
136
135
137
**When we speak of free software, we are referring to freedom, not price.**
This project follows [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0)protocol，the detailed content of License please see the [LICENSE](./LICENSE)file。
1.Security issues: Because it is a vulnerability shooting range, it is not recommended to use it on the public network
148
+
1.The security repair code in the project is for reference only, and the actual business vulnerability repair may be much more complex...
149
+
1.**Problem/Suggestion feedback: If you encounter some project problems or better suggestions, you are welcome to raise an Issue or add a communication group for feedback **
150
+
1.**See here, if the master thinks the project is useful, please move and click a star, thank you very much 🙏**
**If the master is also interested in development security, application security, SDL, vulnerability shooting range, etc., welcome to join the exchange group to discuss... **
If you find this tool helpful, consider supporting the author's development efforts. Your sponsorship will be used to maintain the online server and continuously optimize the project function, thank you very much for your encouragement and support!
0 commit comments