# SCJ - Writing Secure Code in Java

![](https://3622500909-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LpsUccoL9AvW9-dz-sO%2Fuploads%2FtNmuWNEFdTYtzjUcrArC%2Fimage.png?alt=media\&token=6f2b1866-9ad7-4eb6-95d1-989105f692c5)

Java is one of the most common object-oriented programming languages used in enterprise and open source projects. Spring is the most popular application development framework for enterprise Java. Millions of developers around the world use Spring Framework to create high-performing, easily testable, and reusable code.

Multiple CVEs have affected Java software, for example, [Log4Shell](https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2021-44228) (CVE-2021-44228) or the most recent [Spring4Shell](https://www.springcloud.io/post/2022-03/spring-framework-rce-early-announcement/) (or SpingShell),  confirming that secure coding requires a combination of processes, tools, and awareness. 

During this course, we will look into multiple web vulnerabilities and we will dissect known CVEs such as Log4Shell and SpringShell. We will also look into the security features of Spring and how to correctly use them to avoid some vulnerabilities. At the end of the course, we will deep dive into  SCA and SAST tools to detect vulnerabilities in our "homemade" vulnerable apps.

**SQL injection example from our labs**

```java
public Product getProduct(int id) {
	Connection conn = DatabaseConnection.getConnection();
	Statement stmt = null;
	try {
		stmt = conn.createStatement();
		String sql;
		sql = "SELECT * FROM product WHERE `product_id` = " + id;
		ResultSet rs = stmt.executeQuery(sql);

		while (rs.next()) {
			return new Product(
				rs.getInt("product_id"), 
				rs.getString("name"), 
				rs.getString("description"),
				rs.getString("image_url"), 
				rs.getDouble("price"), 
				rs.getDouble("star"));
		}
	} catch (Exception e) {
		System.err.println(e.getMessage());
		e.printStackTrace();
	} finally {
		DatabaseConnection.releaseConnection(conn);
	}
	return null;
}
```

## Prerequisites

* Knowledge of Java and Spring Framework 
* Interest in security 

## Target audience

* Security Engineers 
* Security Champions
* DevOps 
* Developers 

## Tools used 

* Any IDE
* Docker 
* Burp Suite Community edition
* Semgrep
* Coffee or Tea ☕️

## Syllabus

<table><thead><tr><th width="194.4977677159986">Module</th><th width="344.86281651815415">Topic</th><th>Details</th></tr></thead><tbody><tr><td><strong>The hacking mindset</strong></td><td></td><td></td></tr><tr><td></td><td>How attackers will look at your Java applications</td><td></td></tr><tr><td><strong>Secure coding introduction</strong></td><td></td><td></td></tr><tr><td></td><td>Secure coding principles</td><td></td></tr><tr><td></td><td>From SDLC to SSDLC</td><td></td></tr><tr><td></td><td>OWASP Top 10 2021</td><td></td></tr><tr><td></td><td>OWASP ASVS and security requirements</td><td></td></tr><tr><td></td><td>CVSS: how to rate vulnerabilities</td><td></td></tr><tr><td><strong>Spring Security Framework</strong></td><td></td><td></td></tr><tr><td></td><td>AuthN and AuthZ in Spring </td><td></td></tr><tr><td></td><td>CSRF protection </td><td></td></tr><tr><td></td><td>Password encoding in Spring </td><td></td></tr><tr><td><strong>Dissecting (in)famous Java CVE</strong></td><td></td><td></td></tr><tr><td></td><td>Log4j to Log4Shell (CVE -2021-44228)</td><td></td></tr><tr><td></td><td>Spring4Shell (CVE-2022-22965)</td><td></td></tr><tr><td><strong>AuthN  and AuthZ attacks</strong> </td><td></td><td></td></tr><tr><td></td><td><strong>LAB:</strong> IDOR (Insecure Direct Object Reference)</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Path Traversal</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> CSRF (Cross-Site Request Forgery)</td><td></td></tr><tr><td></td><td>Spring actuators exploitation</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> LDAP injection and authentication bypass</td><td></td></tr><tr><td><strong>Attacking a Spring web application</strong></td><td></td><td></td></tr><tr><td></td><td><strong>LAB:</strong> XSS (dom, reflected, and stored)</td><td></td></tr><tr><td></td><td>Spring Security Headers and CSP </td><td></td></tr><tr><td></td><td>Client side Open redirect </td><td></td></tr><tr><td><strong>Server Side Injections in Java</strong></td><td></td><td></td></tr><tr><td></td><td><strong>LAB:</strong> SQL injections</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Command injection</td><td></td></tr><tr><td></td><td></td><td>Abusing <code>Runtime.getRuntime().exec(cmd)</code></td></tr><tr><td></td><td><strong>LAB:</strong> Code and Object Injection</td><td></td></tr><tr><td></td><td></td><td> Expliting <code>eval()</code></td></tr><tr><td></td><td></td><td>Deserialization to RCE </td></tr><tr><td></td><td><strong>LAB:</strong> XML Injections</td><td></td></tr><tr><td></td><td></td><td>From XML to SSRF wiht <code>xinclude</code></td></tr><tr><td></td><td></td><td>Exploiting XXE and XML Bomb (million laugh attacks)</td></tr><tr><td></td><td><strong>LAB:</strong> Server-Side Request Forgery</td><td></td></tr><tr><td></td><td></td><td>Basics of SSRF</td></tr><tr><td></td><td></td><td>Exploiting SSRF using DNS localhost resolution</td></tr><tr><td></td><td><strong>LAB:</strong> NoSQL injections</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Local and remote file inclusion</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Server Side Template Injections</td><td></td></tr><tr><td></td><td></td><td><strong>LAB:</strong> Exploiting <code>FreeMaker</code> templates</td></tr><tr><td></td><td></td><td><strong>LAB:</strong> Exploiting <code>Velocity</code>  templates</td></tr><tr><td></td><td></td><td><strong>LAB:</strong>  Expression Language (EL) injections</td></tr><tr><td><strong>Vulnerable and Outdated Dependencies</strong></td><td></td><td></td></tr><tr><td></td><td>Dependencies as graph</td><td></td></tr><tr><td></td><td>The importance of SCA (Static Component Analysis)</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Detecting known vulnerabilities using Snyk</td><td></td></tr><tr><td></td><td>Integrate SCA in the CI/CD pipeline</td><td></td></tr><tr><td></td><td><code>maven</code></td><td></td></tr><tr><td></td><td>Detecting vulnerabilities in Java using SCA</td><td></td></tr><tr><td><strong>Scanning your code using Semgrep</strong></td><td></td><td></td></tr><tr><td></td><td>Semgrep basics</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Semgrep for Java: How to write rules </td><td></td></tr><tr><td></td><td>Semgrep automation</td><td></td></tr></tbody></table>

## **Trainers**

<details>

<summary>Davide Cioccia </summary>

As the Founder and Principal Security Architect @ DCODX, I focus on hacking and securing web and mobile applications. I'm active in the security community as OWASP [MSTG](https://github.com/OWASP/owasp-mstg/blob/master/Crackmes/README.md) contributor,  [DevSecCon](https://www.devseccon.com/events) Chapter Lead for the Netherlands and speaker at major conferences such as BlackHat, OWASP AppSec and DevSecCon, where I talk about DevSecOps, secure coding and OSINT techiniques. Check my full profile on LinkedIn or send me an email at <davide@dcodx.com> if you want to know more about me and the trainings I teach.

Follow me on:&#x20;

Twitter: <https://twitter.com/davide107>

GitHub: <https://github.com/david3107>

LinkedIn: <https://www.linkedin.com/in/davidecioccia/>

</details>

## Why should you attend this course?&#x20;

This course will teach you the inside out of exploiting and securing Java applications via real-life examples. If you are a Java developer this is the course for you.&#x20;

{% hint style="info" %}

### More info? Contact us at <trainings@dcodx.com>

{% endhint %}