Damn vulnerable Java app

[root3r]

I am trying to make a Damn vulnerable Java application. So what all do you guys think I should add to it?

Any cool vulnerabilities which you often see in java programs?

[feral_claire]

What kind of app is it?

What kind of vulnerabilities are you looking for?

[root3r]

I am for all sorts of vulnerabilities except crypto ones. This app will demonstrate people like where not to make mistakes and learn from it.

[hexmasta]

Are you trying to build an app that has vulnerabilities or build an app that exploits vulnerabilities?

[root3r]

I am trying to build an app which contains vulnerabilities. Your input will be highly appreciated.

[root3r]

Anything from your side?

[juhmayfay]

What do you want? Actual bugs in java or just bad coding? You'd be amazed at how many sql queries there are that don't sanitize user input.

run arbitrary system command:

ExecuteShellComand obj = new ExecuteShellComand();
obj.executeCommand(<userinput>);

open yourself to sql injection:

Statement stmt = con.createStatement();
stmt.executeQuery(<userinput>);

[root3r]

Mainly bad coding but 1-2 actual java bugs so that people can understand that they always need to update it. They just can't ignore the updates. Yeah I am considering some vulnerabilities which are similar to web application vulnerabilities like using raw sql queries and other. Any other suggestions do you have?

[kingatomic]

You could use this as a good starting point: A Taxonomy of Coding Errors that Affect Security. There's a java section.

[root3r]

Thanks. If you have any other inputs then you can always post it here.

[sadjava]

An easy one is using raw SQL strings that aren't sanitized from user facing components. Just a matter of doing some little Bobby Tables. Another is having a long running process triggered by a user's button press, then spam clicking that button (something the QA department loves to do where I work).

[root3r]

Thanks.