veracode-local / vulnado

Vulnado - Intentionally Vulnerable Java Application

This application and exercises will take you through some of the OWASP top 10 Vulnerabilities and how to prevent them.

kajgh

1. Install Docker for MacOS or Windows. You'll need to create a Docker account if you don't already have one.
2. git clone git://github.com/ScaleSec/vulnado
3. cd vulnado
4. docker-compose up
5. Open a browser and navigate to the client to make sure it's working: http://localhost:1337
6. Then back in your terminal verify you have connection to your API server: nc -vz localhost 8080

Architecture

The docker network created by docker-compose maps pretty well to a multi-tier architecture where a web server is publicly available and there are other network resources like a database and internal site that are not publicly available.

Exercises

• SQL Injection
• XSS - Cross Site Scripting
• SSRF - Server Side Request Forgery
• RCE - Remote Code Execution & Reverse Shell

TEST TEST2 TEST3 TEST4 TEST5 TEST6 TEST7 TEST8 TEST9

vulnado's Issues

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') ('SQL Injection') [VID:2]

https://github.com/veracode-local/vulnado/blob/beecb051930efed284659e99d9081100c3aa2440/com/scalesec/vulnado/User.java#L44-L54

Filename: User.java

Line: 49

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable query. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') ('Command or Argument Injection') [VID:1]

https://github.com/veracode-local/vulnado/blob/36e4798d7d118e055c6bf780d6c6faf8f51c0d6c/com/scalesec/vulnado/Cowsay.java#L11-L21

Filename: Cowsay.java

Line: 16

CWE: 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') ('Command or Argument Injection'))

This call to java.lang.ProcessBuilder.start() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. start() was called on the processBuilder object, which contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/scalesec/vulnado/User.java:49]

https://github.com/veracode-local/vulnado/blob/aa3e015b0277792f6d23fb8488566d7e1985461b/com/scalesec/vulnado/User.java#L44-L54

Filename: com/scalesec/vulnado/User.java

Line: 49

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable query. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/scalesec/vulnado/User.java:49]

https://github.com/veracode-local/vulnado/blob/63f54090dc4e2030057bb3504f218ec0eafe2328/com/scalesec/vulnado/User.java#L44-L54

Filename: com/scalesec/vulnado/User.java

Line: 49

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable query. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') ('SQL Injection') [VID:2]

https://github.com/veracode-local/vulnado/blob/762996633cdf4c6004ec3599d09c56ccb3507db9/com/scalesec/vulnado/User.java#L44-L54

Filename: User.java

Line: 49

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable query. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/scalesec/vulnado/User.java:49]

https://github.com/veracode-local/vulnado/blob/44c813cd25e9c7dd90e524d30010bd6e148cf066/com/scalesec/vulnado/User.java#L44-L54

Filename: com/scalesec/vulnado/User.java

Line: 49

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable query. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') ('Command or Argument Injection') [VID:1]

https://github.com/veracode-local/vulnado/blob/762996633cdf4c6004ec3599d09c56ccb3507db9/com/scalesec/vulnado/Cowsay.java#L11-L21

Filename: Cowsay.java

Line: 16

CWE: 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') ('Command or Argument Injection'))

This call to java.lang.ProcessBuilder.start() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. start() was called on the processBuilder object, which contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') ('SQL Injection') [VID:2]

https://github.com/veracode-local/vulnado/blob/aa3e015b0277792f6d23fb8488566d7e1985461b/com/scalesec/vulnado/User.java#L44-L54

Filename: User.java

Line: 49

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable query. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/scalesec/vulnado/User.java:49]

https://github.com/veracode-local/vulnado/blob/38d986c2769993f7bd50fe80390d8149b6f76013/com/scalesec/vulnado/User.java#L44-L54

Filename: com/scalesec/vulnado/User.java

Line: 49

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable query. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/scalesec/vulnado/User.java:49]

https://github.com/veracode-local/vulnado/blob/beecb051930efed284659e99d9081100c3aa2440/com/scalesec/vulnado/User.java#L44-L54

Filename: com/scalesec/vulnado/User.java

Line: 49

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable query. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') [VID:78:com/scalesec/vulnado/Cowsay.java:16]

https://github.com/veracode-local/vulnado/blob/5f94e784659663cc24a2c95cb4ac73412d34a883/com/scalesec/vulnado/Cowsay.java#L11-L21

Filename: com/scalesec/vulnado/Cowsay.java

Line: 16

CWE: 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))

This call to java.lang.ProcessBuilder.start() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. start() was called on the processBuilder object, which contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') [VID:78:com/scalesec/vulnado/Cowsay.java:16]

https://github.com/veracode-local/vulnado/blob/63f54090dc4e2030057bb3504f218ec0eafe2328/com/scalesec/vulnado/Cowsay.java#L11-L21

Filename: com/scalesec/vulnado/Cowsay.java

Line: 16

CWE: 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))

This call to java.lang.ProcessBuilder.start() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. start() was called on the processBuilder object, which contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/scalesec/vulnado/User.java:49]

https://github.com/veracode-local/vulnado/blob/63f54090dc4e2030057bb3504f218ec0eafe2328/com/scalesec/vulnado/User.java#L44-L54

Filename: com/scalesec/vulnado/User.java

Line: 49

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable query. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') ('Command or Argument Injection') [VID:1]

https://github.com/veracode-local/vulnado/blob/63f54090dc4e2030057bb3504f218ec0eafe2328/com/scalesec/vulnado/Cowsay.java#L11-L21

Filename: Cowsay.java

Line: 16

CWE: 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') ('Command or Argument Injection'))

This call to java.lang.ProcessBuilder.start() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. start() was called on the processBuilder object, which contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') ('SQL Injection') [VID:2]

https://github.com/veracode-local/vulnado/blob/63f54090dc4e2030057bb3504f218ec0eafe2328/com/scalesec/vulnado/User.java#L44-L54

Filename: User.java

Line: 49

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable query. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/scalesec/vulnado/User.java:49]

https://github.com/veracode-local/vulnado/blob/5f94e784659663cc24a2c95cb4ac73412d34a883/com/scalesec/vulnado/User.java#L44-L54

Filename: com/scalesec/vulnado/User.java

Line: 49

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable query. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode