Remove Website Tester (#9)

* use InetAddress functionality instead of hand-crafted verification

* remove the WebsiteTestService and focus on the DomainTestService

* revert tests

Author: CodingDepot

README.md

@@ -1,39 +1,25 @@
 # Vulnerable Java application
 
-This repository contains a sample application, the "Websites Tester Service", that's vulnerable to a [Command Injection](https://owasp.org/www-community/attacks/Command_Injection) and [Server-Side Request Forgery (SSRF)](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/) vulnerability.
+This repository contains a sample application, the "Websites Tester Service", that's vulnerable to a [Command Injection](https://owasp.org/www-community/attacks/Command_Injection) vulnerability.
 
 > **Warning!**
 > This application is purposely vulnerable and can trivially be hacked. Don't expose it to the Internet, and don't run it in a production environment.
 > Instead, you can run it locally on your machine, or in a cloud environment on a private VPC.
 
 ## Running locally
 
-1. Build the image locally, or use `ghcr.io/datadog/vulnerable-java-application`:
+1. Build the image locally: 
+   ```
+   docker build -t vulnerable-java-application:latest .
+   ```
 2. Run:
     ```
-    docker run --rm -p 8000:8000 ghcr.io/datadog/vulnerable-java-application
+    docker run --rm -p 8000:8000 vulnerable-java-application:latest
     ```
 3. You can then access the web application at <http://127.0.0.1:8000>
 
-## Running on Kubernetes
-
-```
-kubectl run  vulnerable-application --port=8000 --expose=true --image ghcr.io/datadog/vulnerable-java-application
-kubectl port-forward pod/vulnerable-application 8000
-```
-
-You can then access the web application at <http://127.0.0.1:8000>
-
 ## Exploitation
 
-### Server-side request vulnerability
-
-1. Browse to <http://127.0.0.1:8000/website.html>
-2. Note how the input allows you to specify arbitrary URLs such as `http://google.com`, but also any internal IP such as `http://169.254.169.254/latest/meta-data/`
-3. When the applications is running in AWS, Azure or GCP, this can often be exploited to retrieve instance metadata credentials
-
-### Command injection vulnerability
-
 1. Browse to <http://127.0.0.1:8000/index.html>
 2. Note how the input allows you to specify domain names such as `google.com` and ping them
 3. Note that there is some level of input validation - entering `$(whoami)` returns `Invalid domain name: $(whoami) - don't try to hack us!`

src/main/java/com/datadoghq/workshops/samplevulnerablejavaapp/MainController.java

@@ -1,7 +1,6 @@
 package com.datadoghq.workshops.samplevulnerablejavaapp;
 
 import com.datadoghq.workshops.samplevulnerablejavaapp.exception.InvalidDomainException;
-import com.datadoghq.workshops.samplevulnerablejavaapp.exception.UnableToTestDomainException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -17,9 +16,6 @@ public class MainController {
   @Autowired
   private DomainTestService domainTestService;
 
-  @Autowired
-  private WebsiteTestService websiteTestService;
-
   @RequestMapping(method=RequestMethod.POST, value="/test-domain", consumes="application/json")
   public ResponseEntity<String> testDomain(@RequestBody DomainTestRequest request) {
     log.info("Testing domain " + request.domainName);
@@ -28,18 +24,8 @@ public ResponseEntity<String> testDomain(@RequestBody DomainTestRequest request)
       return new ResponseEntity<>(result, HttpStatus.OK);
     } catch(InvalidDomainException e) {
       return new ResponseEntity<>(e.getMessage(), HttpStatus.BAD_REQUEST);
-    } catch (UnableToTestDomainException e) {
-      return new ResponseEntity<>(e.getMessage(), HttpStatus.INTERNAL_SERVER_ERROR);
-    } catch(Exception e) {
+    } catch (Exception e) {
       return new ResponseEntity<>(e.getMessage(), HttpStatus.INTERNAL_SERVER_ERROR);
     }
   }
-
-  @RequestMapping(method=RequestMethod.POST, value="/test-website", consumes="application/json")
-  public ResponseEntity<String> testWebsite(@RequestBody WebsiteTestRequest request) {
-    log.info("Testing website " + request.url);
-    String result = websiteTestService.testWebsite(request);
-    return new ResponseEntity<>(result, HttpStatus.OK);
-  }
-
 }