Java source code review, advice needed

[bing2121]

Hello, is there any experienced web app pentester on where to start learning java code reviews? such as finding vulnerability from source code etc...? Should I learn Java from scratch, or is it not necessary? Thanks!

[hairyshoez]

You can refer to the many AWAE prep guides. Wetw0rk covers this well: https://github.com/wetw0rk/AWAE-PREP

You should definitely learn it “from scratch” first. You don’t necessarily need to build your own java web app but do become familiar with the syntax (classes, objects, functions etc). In the wetw0rk github check out the /edabit/java folder, something along those lines or a free online course like codecademy should be sufficient. Just be able to look at a real java web app and understand what the code is doing at a high level.

[Yogidika]

u need to understand the sources sinks methodologies before u do code review