k-tamura / easybuggy4sb Goto Github PK

EasyBuggy clone build on Spring Boot

Java 11.56% HTML 4.04% CSS 83.24% Dockerfile 0.11% FreeMarker 0.76% Shell 0.29%

spring-boot java-8 buggy vulnerabilities errors exceptions troubleshooting performance

easybuggy4sb's Introduction

EasyBuggy Boot 🍀

This is a clone of EasyBuggy built on Spring Boot. EasyBuggy is a broken web application in order to understand behavior of bugs and vulnerabilities, for example, memory leak, deadlock, JVM crash, SQL injection and so on.

🕓 Quick Start (Docker Compose) with Keycloak, MySQL, Attacker's app

$ echo HOST=192.168.1.17 > .env # if you run EasyBuggy Boot not on localhost (e.g. 192.168.1.17)
$ docker compose up

Access to

http://192.168.1.17:8080

🕓 Quick Start

$ mvn spring-boot:run

( or java -jar ROOT.war or deploy ROOT.war on your servlet container with the JVM options. )

⚠️ Java 7 or 8 is needed. Doesn't work with Java 9 or later.

🕓 Quick Start (Docker)

$ docker build . -t easybuggy4sb       # Build container image
$ docker run -p 8080:8080 easybuggy4sb # Start easybuggy

Access to

http://localhost:8080

To stop:

Use CTRL+C

🕓 For more detail

See the wiki page.

🕓 Demo

This demo shows: Start up -> Infinite Loop -> LDAP Injection -> UnsatisfiedLinkError -> BufferOverflowException -> Deadlock -> Memory Leak -> JVM Crash (Shut down)

easybuggy4sb's People

Contributors

Stargazers

Watchers

easybuggy4sb's Issues

Client information page doesn't have function description

The client information page have no function description.

Cannot show client and server information

clientinfo.html can't show client information. The same is true as serverinfo.html.

Cannot localize in accordance with browser's language setting

EasyBuggy Boot cannot be localized in accordance with browser's language setting.

DeadlockController2 does not rollback when deadlock occurs

Currently, DeadlockController2 does not rollback when a deadlock occurs.

Client and server information pages are not localized

The client information page is not localized. The same is true as the server information page

Suppress noisy ESAPI messages

ESAPI records the following messages at first access:

System property [org.owasp.esapi.opsteam] is not set
System property [org.owasp.esapi.devteam] is not set
Attempting to load ESAPI.properties via file I/O.
Attempting to load ESAPI.properties as resource file via file I/O.
Not found in 'org.owasp.esapi.resources' directory or file not readable: C:\Users\ktamura\git\easybuggy4sb\ESAPI.properties
Not found in SystemResource Directory/resourceDirectory: .esapi\ESAPI.properties
Not found in 'user.home' (C:\Users\ktamura) directory: C:\Users\ktamura\esapi\ESAPI.properties
Loading ESAPI.properties via file I/O failed. Exception was: java.io.FileNotFoundException
Attempting to load ESAPI.properties via the classpath.
SUCCESSFULLY LOADED ESAPI.properties via the CLASSPATH from '/ (root)' using current thread context class loader!
SecurityConfiguration for Validator.ConfigurationFile.MultiValued not found in ESAPI.properties. Using default: false
Attempting to load validation.properties via file I/O.
Attempting to load validation.properties as resource file via file I/O.
Not found in 'org.owasp.esapi.resources' directory or file not readable: C:\Users\ktamura\git\easybuggy4sb\validation.properties
Not found in SystemResource Directory/resourceDirectory: .esapi\validation.properties
Not found in 'user.home' (C:\Users\ktamura) directory: C:\Users\ktamura\esapi\validation.properties
Loading validation.properties via file I/O failed.
Attempting to load validation.properties via the classpath.
validation.properties could not be loaded by any means. fail. Exception was: java.lang.IllegalArgumentException: Failed to load ESAPI.properties as a classloader resource.

NPE occurs when clicking link to serverinfo.html on directory listing page

NullPointerException occurs when clicking serverinfo.html on the directory listing page.

Improve mathjax performance

Mathematical expressions is too slow to display...