Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

I am looking for some open source/free vulnerable JAVA based applications. It can be web application, desktop application or any other. I need them to do some experiments in my research work. They could be very small or medium size but it's nice if it is like real world application.

The vulnerability may include XSS attack, accessing unauthorized data, sql-injuction etc.

I already tried OWASP applications but need some more.

Could somebody please suggest where can I find such vulnerable/exploitable java applications ?

Thanks.

share|improve this question
Can't you just create your own? – Ramhound Sep 17 '12 at 14:07
@Ramhound:- I want to try different vulnerabilities so it is really time taking to create an application for each scenario.. – Ragini Sep 18 '12 at 14:06

3 Answers

up vote 6 down vote accepted

If you are new to hunting I recommend starting out with WebGoat or Damn Vulnerable WebApp (DVWA). This is because it frames each vulnerability nicely, you just have to point and shoot. You can practice exploitation, and working with a real vulnerability. "The shooting range"

There are real applications that where intentionally written to be insecure (Like the Hacme series, which is under SASS Tools). The Dojo has a collection of these apps loaded onto a VM as well as tools to audit them. This is really the 2nd step because now you have to find where to shoot. "Hunting on the farm"

The 3rd step is going out and finding a real application. Search github/sourceforge/bitbucket/ect for web applications that are less than a year old and aren't that popular. These apps will vary, but most often then will be very insecure. "Hunting in the wild"

After that start working your way up to more popular applications, get CVE numbers, write exploit code, and explore newly developed exploitation techniques: exploit-db.com . "It gets more wild..."

share|improve this answer
To be clear - the assumption is that if you're 'hunting in the wild', the 'preserve' is on a machine you have legal access to. If you start finding vulnerabilities for opensource projects by hunting in somebody else's preserve (that is, against a machine you don't have the legal right to access), the have every right to report you. Permission in writing is otherwise required. – Clockwork-Muse Sep 12 '12 at 23:24
@X-Zero i don't see how this applies to my post. Performing a backbox analysis of a publicly available applications is inefficient to say the least. – Rook Sep 12 '12 at 23:30
2  
I just wanted to make it clear that, when you run against a 'live' instance to confirm the vulnerability, you need to run against something you have legal access to. You can't just run against somebody else's instance - you need legally verifiable permission. – Clockwork-Muse Sep 13 '12 at 15:26
up vote 1 down vote

Take a look at SpringMVC jPetStore it has a number of nice vulnerabilities.

See http://o2platform.wordpress.com/category/java/spring-mvc/jpetstore/ for detailS, examples, code samples and fixes

share|improve this answer
up vote 1 down vote

Check out Stanford SecuriBench. It is a collection of open-source Java web applications that have had a variety of vulnerabilities, and which were used in some previous research papers to evaluate research tools. The collection is old (2005?) but it might still be useful for your purposes.

The benchmark includes both artificial applications that were designed to showcase some vulnerabilities (like WebGoat), as well as some realistic applications that were taken from real life and are not artificial. I think the latter is probably more useful for evaluation of tools, as they are more likely to be representative of coding patterns in real applications.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.