This repository contains several Java web applications and command line applications covering different security topics. Have a look at my slides and publications covering most applications in this repository.

• Java 25
• Maven 3.6.3+
• Mozilla Firefox (recommended, some demos might not be fully working in other browsers)
• Docker (required for running the sample applications as Docker containers)

Some web applications contain exercises, some are only there to inspect and learn. Instructions are provided in detail on the start page of each web application.

Some web applications are based on Spring Boot and can be started via the main method in the Application class or via mvn spring-boot:run in the project directory. Spring Boot projects can be launched via docker run -p 8080:8080 dschadow/[PROJECT]:[VERSION] after the image has been created using mvn spring-boot:build-image. The other web applications are plain Jakarta Servlet applications which run on Apache Tomcat 11 via the Cargo Maven plugin and can be started via mvn package cargo:run in the project directory.

Access control demo project using Spring Security in a Spring Boot application. Shows how to safely load user data from a database without using potentially faked frontend values. After launching, open the web application in your browser at http://localhost:8080.

Spring Boot based web application using a Content Security Policy (CSP) header. After launching, open the web application in your browser at http://localhost:8080.

Cross-Site Request Forgery (CSRF) demo project based on Spring Boot preventing CSRF in a web application by using Spring Security. After launching, open the web application in your browser at http://localhost:8080.

Cross-Site Request Forgery (CSRF) demo project preventing CSRF in a JavaServer Pages (JSP) web application with an anti CSRF token implementation based on the Enterprise Security API (ESAPI). After launching, open the web application in your browser at http://localhost:8080/csrf.

Direct object references (and indirect object references) demo project using Spring Boot and using the Enterprise Security API (ESAPI). After launching, open the web application in your browser at http://localhost:8080.

Spring Boot based web application to experiment with ZAP as an intercepting proxy. Target is to receive SUCCESS from the backend. After launching, open the web application in your browser at http://localhost:8080.

Security response header demo project which applies X-Content-Type-Options, Cache-Control, X-Frame-Options, HTTP Strict Transport Security (HSTS), X-XSS-Protection and Content Security Policy (CSP) (Level 1 and 2) headers to HTTP responses. After launching, open the web application in your browser at http://localhost:8080/security-header or https://localhost:8443/security-header.

Spring Boot based web application utilizing the OWASP Security Logging Project. Demonstrates how to log security relevant incidents with security markers. After launching, open the web application in your browser at http://localhost:8080.

Session handling demo project based on Spring Boot utilizing Spring Security. Shows how to restrict access to resources (URLs), how to apply method level security and how to store and verify hashed passwords. Uses Spring Security for all security-related functionality. After launching, open the web application in your browser at http://localhost:8080.

Session handling demo project using plain Java. Uses plain Java to create and update the session id after logging in. After launching, open the web application in your browser at http://localhost:8080/session-handling.

Spring Boot based web application to experiment with normal (vulnerable) statements, statements with escaped input, and prepared statements. After launching, open the web application in your browser at http://localhost:8080.

Cross-Site Scripting (XSS) demo project preventing XSS in a JavaServer Pages (JSP) web application by using input validation, output escaping with OWASP Java Encoder and the Content Security Policy (CSP). After launching, open the web application in your browser at http://localhost:8080/xss.

The crypto projects demonstrate crypto usage in Java with different libraries. Each project contains one or more JUnit test classes to test various functionalities of the demo project.

Crypto demo using Java to hash passwords with different hashing algorithms.

Crypto demo using plain Java to encrypt and decrypt data with asymmetric (RSA) and symmetric (AES) algorithms as well as to sign and verify data (DSA). Includes post-quantum samples for key encapsulation (ML-KEM) and digital signatures (ML-DSA) as well as key derivation with HKDF using the Key Derivation Function API.

Crypto demo using Apache Shiro to encrypt and decrypt data with symmetric (AES) algorithms as well as hash data (passwords).

Crypto demo using Google Tink to encrypt and decrypt data with asymmetric and hybrid encryption, MAC and digital signatures. Depending on the demo, keys are either generated on the fly or stored/loaded from the keysets' directory. The AWS KMS samples (classes with AwsKms in their names) require a configured AWS KMS with an enabled master key.

Java serialization demo showing the risks of deserializing untrusted data. Run the main method of the Serializer class first to create the serialized file, then the main method of the Deserializer class to read it again.