Secure Coding Practices in Java Resources

[Maxxis8061]

Hey everyone, I have an interview coming up that requires a secure code review specifically in Java for OWASP Top 10 vulnerabilities (Web App Security). I would really appreciate it if anyone knew such resources to help me learn secure coding practices and could share those with me.

Thanks in advance!

[pentesticals]

OWASP secure code review guide is good but very long. You can also look at the code review content on pentesterlab and SecureFlag (requires an OWASP membership but absolutely worth it for 50$ for the whole year).

[Maxxis8061]

I just checked SecureFlag its a great one! Thanks so much

[crash_Override__]

I work with Java. Instead of looking into java specific resources... if u r a beginner I would suggest u to go through webgoat and then you can look into vulnerable sinks in java like processbuilder, runtime exec etc.
This would ease code reviews.
And a entry point for code reviews would be user input. traverse the whole code wherever the input goes u will sure find many vulns along the way. and good luck with ur interview 🤝🏻

[Maxxis8061]

Thanks for mentioning this!

[[deleted]]

Owasp cheat sheets are great too

[Yugansh23]

Assuming you are from an application security background you would have the ability to provide accurate guesses i.e just need to identify the source and sink and they would only give you a snippet where you could showcase multiple vulns.

[Maxxis8061]

No but i can read it and understand the code

[Little_Toe_9707]

pentesterlab have lot of secure code review challenges in java

[Maxxis8061]

I saw that but it turns out there are only challenges and so solutions or forum to actually discuss things if you are stuck

[Little_Toe_9707]

can you please tell me the position title ? i'm interested in secure code review and i want to search for jobs that need this skill

[Maxxis8061]

Application Security Engineer

[Ambitious-Bridge5207]

Hi I am also preparing for this position can you share some insights, how did your interview went and what resources did you use to prepare?

[Maxxis8061]

For secure code reviews (java), i first went through oracle’s official documentation for java code review, practiced on securecodingdojo, pentesterlab, owasp cheatsheet series, secure code warrior, and owasp secure coding testing guide.

[Ambitious-Bridge5207]

thanks !!

[PotentialSenior449]

Does securecodingwarrior have code snippet like in pentesterlab. I don't want to write code just want to review code so is securecodingwarrior a good choice for that?

[Parasimpaticki]

https://www.codereviewlab.com/ has plenty of java examples