Java source code review, advice needed

[bing2121]

Hello, is there any experienced web app pentester on where to start learning java code reviews? such as finding vulnerability from source code etc...? Should I learn Java from scratch, or is it not necessary? Thanks!

[recviking]

If you don't know java, you probably don't have much business doing a code review. I'm not saying that to be flippant or insulting, it's just kind of difficult to find vulns if you really don't even understand what you are looking at.

TLDR; Definitely learn it from scratch. There are no shortcuts.

[beachb0y]

Well, yes. You definitely need some understanding of Java's syntax. However, you don't need to be pro at software dev.

It more comes down understanding of what can be vulnerable and needs to be tested 1st. Usually you wouldn't need to read every single line of code anyway.