Skip to content

Commit 153f664

Browse files
KojanAbzakhKojanAbzakh
committed
init
0 parents  commit 153f664

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

84 files changed

+4204
-0
lines changed

‎Dockerfile

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
FROM ubuntu:17.10
2+
ENV WORKDIR /usr/src/app/
3+
WORKDIR $WORKDIR
4+
COPY package*.json $WORKDIR
5+
RUN npm install --production --no-cache
6+
7+
FROM node:12-alpine
8+
ENV USER node
9+
ENV WORKDIR /home/$USER/app
10+
WORKDIR $WORKDIR
11+
COPY --from=0 /usr/src/app/node_modules node_modules
12+
RUN chown $USER:$USER $WORKDIR
13+
COPY --chown=node . $WORKDIR
14+
# In production environment uncomment the next line
15+
#RUN chown -R $USER:$USER /home/$USER && chmod -R g-s,o-rx /home/$USER && chmod -R o-wrx $WORKDIR
16+
# Then all further actions including running the containers should be done under non-root user.
17+
USER $USER
18+
EXPOSE 4000

‎LICENSE

+340
Large diffs are not rendered by default.

‎README.md

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
This is a "Vulnerable" Web Application developed by Cyber Security and Privacy Foundation(www.cysecurity.org). This app is intended for the Java Programmers and other people who wish to learn about Web application vulnerabilities and write secure code.
2+
3+
**The full course content is now available on Github for free:**
4+
5+
https://github.com/CSPF-Founder/JavaSecurityCourse
6+
7+
8+
**The full course on Hacking and Securing Web Java Programs is available in**
9+
10+
https://www.udemy.com/hacking-securing-java-web-programming/
11+
12+
**Warning**: Don't run this app in Your Main Machine or in an online server. Install it in Vitual Machine.
13+
14+
15+
How to Use/Setup ?
16+
-------------
17+
18+
**Method 1.Super Very Easiest Method: Docker**
19+
The easiest way to use Java Vulnerable is using Docker which set up everything for you with 1 command line
20+
21+
Steps:
22+
23+
1. Install Docker: https://docs.docker.com/engine/installation/
24+
2. Install docker-compose: https://docs.docker.com/compose/install/
25+
3. Inside this directory, run `sudo docker-compose up` and wait untill everything is configured for you.
26+
4. In your Browser, go to "http://localhost:8080/JavaVulnerableLab/install.jsp
27+
5. Change the JDBC URL from jdbc:mysql://localhost:3306 to jdbc:mysql://mysql:3306
28+
6. Click the Install Button
29+
7. Enjoy :)
30+
31+
32+
**Method 2.Very Easiest Method : VirtualBox VM**
33+
The second most easiest way to use Java Vulnerable is using the VirtualBox VM which has everything set up and ready to use.
34+
35+
Steps:
36+
37+
1. Install the VirtualBox : https://www.virtualbox.org/wiki/Downloads
38+
2. Download the VM Image from here : http://sourceforge.net/projects/javavulnerablelab/files/v0.1/JavaVulnerableLab.ova/download
39+
3. Import the JavaVulnerable.ova into VirtualBox.
40+
4. Change the Network Settings to Host-Only Network
41+
5. Start the Machine and Log into the Machine( Credentials; username: root password: cspf)
42+
6. Start Tomcat by entering "service tomcat start" in the Terminal
43+
7. Start mysql by entering "service mysql start" in the Terminal
44+
8. Find the IP Address of Machine
45+
9. In your Browser, go to "http://[IP_ADDRESS_OF_VM]:8080/JavaVulnerableLab/install.jsp
46+
10. Click the Install Button
47+
11. Enjoy :)
48+
49+
**Method 3.Easiest Method : Standalone Web Application**
50+
In this mehtod, you will be running an executable "JAR" file which runs the application with an embedded Apache Tomcat.
51+
52+
Steps:
53+
54+
1. Install JDK
55+
2. Download Executable Jar from here: http://sourceforge.net/projects/javavulnerablelab/files/v0.2/JavaVulnerableLab.jar/download
56+
3. Double Click the JavaVulnerable.jar to run( if double click is not working, run this command "java -jar JavaVulnerable.jar" in your Terminal or CMD)
57+
4. In your Browser, go to "http://localhost:8080/JavaVulnerableLab/install.jsp
58+
5. Click the Install Button
59+
60+
**Method 4. Using War file:**
61+
This is a NORMAL method to deploy the WAR file.
62+
63+
Steps:
64+
65+
1. Install Apache Tomcat server
66+
2. Go to http://[Tomcat_INSTALLED_IP]:8080/manager/ (make sure you have modified tomcat-users.xml file of the tomcat to allow the manager).
67+
3. Download our WAR file from here: https://sourceforge.net/projects/javavulnerablelab/files/latest/JavaVulnerableLab.war/download
68+
4. Deploy the WAR in Apache Tomcat manager.
69+
5. Go to http://[Tomcat_INSTALLED_IP]:8080/JavaVulnerableLab/install.jsp
70+
6. Click the Install Button
71+
72+
73+
Get the VulnerableSpring Project from here:
74+
https://github.com/CSPF-Founder/VulnerableSpring
75+

‎docker-compose.yml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
javavulnlab:
2+
build: .
3+
ports:
4+
- 8080:8080
5+
links:
6+
- mysql
7+
8+
mysql:
9+
image: mysql
10+
environment:
11+
- MYSQL_ROOT_PASSWORD=root

‎infrostructure.tf

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
#### INSTANCE HTTP ####
2+
3+
resource "aws_lb" "front_end" {
4+
# ...
5+
}
6+
7+
resource "aws_lb_target_group" "front_end" {
8+
# ...
9+
}
10+
11+
resource "aws_lb_listener" "front_end" {
12+
load_balancer_arn = aws_lb.front_end.arn
13+
port = "80"
14+
protocol = "HTTP"
15+
16+
default_action {
17+
type = "redirect"
18+
19+
redirect {
20+
port = "80"
21+
protocol = "HTTP"
22+
status_code = "HTTP_301"
23+
}
24+
}
25+
}
26+
27+
resource "aws_alb_listener" "front_end" {
28+
load_balancer_arn = aws_lb.front_end.arn
29+
port = "8080"
30+
protocol = "HTTP"
31+
}
32+
33+
# Create instance
34+
resource "aws_instance" "http" {
35+
for_each = var.http_instance_names
36+
ami = data.aws_ami.ubuntu.id
37+
instance_type = "t2.micro"
38+
key_name = aws_key_pair.user_key.key_name
39+
vpc_security_group_ids = [
40+
aws_security_group.administration.id,
41+
aws_security_group.web.id,
42+
]
43+
subnet_id = aws_subnet.http.id
44+
user_data = "1234567890123456789012345678901234567890$"
45+
tags = {
46+
Name = each.key
47+
}
48+
}
49+
50+
# Attach floating ip on instance http
51+
resource "aws_eip" "public_http" {
52+
for_each = var.http_instance_names
53+
vpc = true
54+
instance = aws_instance.http[each.key].id
55+
depends_on = [aws_internet_gateway.gw]
56+
tags = {
57+
Name = "public-http-${each.key}"
58+
}
59+
}

‎pom.xml

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<groupId>org.cysecurity</groupId>
5+
<artifactId>JavaVulnerableLab</artifactId>
6+
<packaging>war</packaging>
7+
<version>0.0.1-SNAPSHOT</version>
8+
<name>JavaVulnerableLab Maven Webapp</name>
9+
<url>http://maven.apache.org</url>
10+
<dependencies>
11+
<dependency>
12+
<groupId>junit</groupId>
13+
<artifactId>junit</artifactId>
14+
<version>3.8.1</version>
15+
<scope>test</scope>
16+
</dependency>
17+
<dependency>
18+
<groupId>mysql</groupId>
19+
<artifactId>mysql-connector-java</artifactId>
20+
<version>5.1.26</version>
21+
</dependency>
22+
<dependency>
23+
<groupId>org.json</groupId>
24+
<artifactId>json</artifactId>
25+
<version>20131018</version>
26+
</dependency>
27+
<dependency>
28+
<groupId>javax.servlet</groupId>
29+
<artifactId>jstl</artifactId>
30+
<version>1.2</version>
31+
</dependency>
32+
<dependency>
33+
<groupId>org.hibernate</groupId>
34+
<artifactId>hibernate-core</artifactId>
35+
<version>4.0.1.Final</version>
36+
</dependency>
37+
<dependency>
38+
<groupId>javax.servlet</groupId>
39+
<artifactId>servlet-api</artifactId>
40+
<version>2.3</version>
41+
<scope>provided</scope>
42+
</dependency>
43+
</dependencies>
44+
<build>
45+
<finalName>JavaVulnerableLab</finalName>
46+
</build>
47+
</project>

‎src/main/java/org/cysecurity/cspf/jvl/controller/AddPage.java

+116
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
/*
2+
* To change this license header, choose License Headers in Project Properties.
3+
* To change this template file, choose Tools | Templates
4+
* and open the template in the editor.
5+
*/
6+
7+
package org.cysecurity.cspf.jvl.controller;
8+
9+
import java.io.BufferedWriter;
10+
import java.io.File;
11+
import java.io.FileWriter;
12+
import java.io.IOException;
13+
import java.io.PrintWriter;
14+
import javax.servlet.ServletException;
15+
import javax.servlet.http.HttpServlet;
16+
import javax.servlet.http.HttpServletRequest;
17+
import javax.servlet.http.HttpServletResponse;
18+
19+
/**
20+
*
21+
* @author breakthesec
22+
*/
23+
public class AddPage extends HttpServlet {
24+
25+
/**
26+
* Processes requests for both HTTP <code>GET</code> and <code>POST</code>
27+
* methods.
28+
*
29+
* @param request servlet request
30+
* @param response servlet response
31+
* @throws ServletException if a servlet-specific error occurs
32+
* @throws IOException if an I/O error occurs
33+
*/
34+
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
35+
throws ServletException, IOException {
36+
response.setContentType("text/html;charset=UTF-8");
37+
PrintWriter out = response.getWriter();
38+
try {
39+
String fileName=request.getParameter("filename");
40+
String content=request.getParameter("content");
41+
if(fileName!=null && content!=null)
42+
{
43+
String pagesDir=getServletContext().getRealPath("/pages");
44+
String filePath=pagesDir+"/"+fileName;
45+
File f=new File(filePath);
46+
if(f.exists())
47+
{
48+
f.delete();
49+
}
50+
if(f.createNewFile())
51+
{
52+
BufferedWriter bw=new BufferedWriter(new FileWriter(f.getAbsoluteFile()));
53+
bw.write(content);
54+
bw.close();
55+
out.print("Successfully created the file: <a href='../pages/"+fileName+"'>"+fileName+"</a>");
56+
}
57+
else
58+
{
59+
out.print("Failed to create the file");
60+
}
61+
}
62+
else
63+
{
64+
out.print("filename or content Parameter is missing");
65+
}
66+
67+
}
68+
catch(Exception e)
69+
{
70+
out.print(e);
71+
}
72+
finally {
73+
out.close();
74+
}
75+
}
76+
77+
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
78+
/**
79+
* Handles the HTTP <code>GET</code> method.
80+
*
81+
* @param request servlet request
82+
* @param response servlet response
83+
* @throws ServletException if a servlet-specific error occurs
84+
* @throws IOException if an I/O error occurs
85+
*/
86+
@Override
87+
protected void doGet(HttpServletRequest request, HttpServletResponse response)
88+
throws ServletException, IOException {
89+
processRequest(request, response);
90+
}
91+
92+
/**
93+
* Handles the HTTP <code>POST</code> method.
94+
*
95+
* @param request servlet request
96+
* @param response servlet response
97+
* @throws ServletException if a servlet-specific error occurs
98+
* @throws IOException if an I/O error occurs
99+
*/
100+
@Override
101+
protected void doPost(HttpServletRequest request, HttpServletResponse response)
102+
throws ServletException, IOException {
103+
processRequest(request, response);
104+
}
105+
106+
/**
107+
* Returns a short description of the servlet.
108+
*
109+
* @return a String containing servlet description
110+
*/
111+
@Override
112+
public String getServletInfo() {
113+
return "Short description";
114+
}// </editor-fold>
115+
116+
}

0 commit comments

Comments
 (0)