Secure coding in Java and common mistakes
You find the most common flaws of Java applications in a weak app in your own lab, understand their root cause, fix them and make the fix stick with tests.
Level 401 · 19 lessons · 15 practice labs
Lessons
Injection and parsing
- SQL and JPQL injection: the cost of concatenated strings
- Command injection with Runtime.exec and ProcessBuilder
- XXE: configuring the XML parser safely
- Expression language and template injection
- Path traversal and zip slip
- Short task: close the injections in the weak app
Objects, logging and dependencies
- Deserialization flaws: how gadget chains work
- ObjectInputFilter and avoiding serialization
- Case study: JNDI lookups and Log4Shell
- Log injection and forged log lines
- Dependency scanning with OWASP Dependency-Check
- Short task: update and verify vulnerable dependencies
Crypto and identity
- JCA mistakes: ECB, fixed IVs and weak hashes
- SecureRandom instead of Random
- Storing passwords: PBKDF2, bcrypt and argon2
- Session and authorisation mistakes
- Information leaks in error pages
- Short task: fix encryption and password storage
Capstone
- Capstone: audit, fix and report on a weak records application
Practice labs
- Closing a concatenated JPQL query: Make a search method that splices user input into a JPQL string parameterised and add a regression test.
- Closing command injection with ProcessBuilder: Convert a conversion service that splices a file name into a shell command to ProcessBuilder with an argument list and add name validation and a timeout.
- Closing template and expression-language injection: Replace a notification template that evaluates user text as an expression with a safe renderer substituting only allowed variables and pass the tests with probe inputs.
- Turning off external entities in the XML parser: Turn off DOCTYPE and external entities in the DocumentBuilderFactory of an order importer and test that a document reading a local file is rejected.
- Blocking directory escape in a download endpoint: Normalise the requested file name against the root directory and reject paths that leave the root or escape through a symlink.
- Zip slip and size limits when unpacking: Block writes outside the target in code unpacking an uploaded archive and add total size, file count and compression ratio limits, passing the tests.
- Preventing forged lines in the log: Neutralise line breaks and control characters in code that writes the user name to the log as is.
- Applying an ObjectInputFilter to serialized input: Add a filter with a class allow-list and depth and size limits to a consumer that reads serialized objects from a queue.
- Taking serialization and log-driven lookups out of service: Move an application that stores session data with Java serialization and performs name lookups in log messages to JSON and an updated logging setup with lookups off, verified by tests.
- Moving token generation to SecureRandom: Replace a reset token generated with java.util.Random by SecureRandom and return it with URL-safe encoding.
- Moving password storage to PBKDF2: Move passwords stored as unsalted MD5 to salted PBKDF2, upgrade the old hash on login after verifying it and compare in constant time.
- Fixing encryption that uses ECB and a fixed IV: Move a module encrypting in ECB mode with a hard-coded key to AES-GCM with a random nonce per message, take the key from outside and write the migration for old data.
- Cutting details leaking from the error page: Replace an error page showing stack traces and version info with a generic message and a request id, writing details only to the log.
- Updating and verifying vulnerable dependencies: Run Dependency-Check with the offline database, close the high-severity findings by upgrading versions and show the tests still pass.
- Closing session and authorisation mistakes: Fix a records application that does not renew the session id on login, lacks cookie flags and does not check record ownership, writing a regression test for each flaw.
About this course
You find the most common flaws of Java applications in a weak app in your own lab, understand their root cause, fix them and make the fix stick with tests.
What you will learn
- Injection and parsing
- Objects, logging and dependencies
- Crypto and identity
- Capstone
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.