Java for AppSec Engineers

Log4j RCE II Pro

Java Serialize 01 Pro

Java Serialize 02 Pro

Java Serialize 03 Pro

XMLDecoder Pro

CVE-2022-21724: JDBC RCE PostgreSQL Pro

Apache Pluto RCE Pro

Java Serialize 04 Pro

Java Serialize 05 Pro

ObjectInputStream Pro

JDBC RCE Pro

Java Serialize 06 Pro

Code Review · Code Execution

Java Code Review 03 Pro

Java Code Review 06 Pro

Code Review · Command Execution

CVE-2020-9x9x Pro

CVE-2022-4504x Pro

CVE-2023-25X4X Pro

CVE-2023-46XX2 Pro

Chapter 2

Injection & XML Attacks

Exploit Struts vulnerabilities and Play Framework XXE, then review SQL injection, LDAP injection, XML external entity, and NoSQL injection patterns in Java code.

Struts s2-045 Pro

Play XML Entities Free

XSL Java Pro

Java Code Review 08 Pro

CVE-2023-350XX Pro

CVE-2022-4x13x Pro

CVE-2020-13xxx Pro

CVE-2022-458X1 Pro

CVE-2022-X50X6 Pro

CVE-202X-2561X Pro

CVE-2022-XX910 Pro

Code Review · LDAP NULL Bind

CVE-2014-X80X Pro

CVE-2023-2XX60 Pro

Code Review · JSON Injection

Java Code Review 14 Pro

Code Review · NoSQL Injection

Java Code Review 11 Pro

Java Snippet #03 Pro

CVE-2007-546X Pro

CVE-2022-357X1 Pro

CVE-2020-11xxx Pro

CVE-2021-39x3x Pro

CVE-2022-3x7x1 Pro

CVE-2023-5X38X Pro

CVE-2024-X875X Pro

Play Session Injection Free

Recommended: Complete Chapter 1 first

Chapter 3

Paths, Web Attacks & Filters

Exploit Spring Actuators, Struts devMode, and Play sessions. Review directory traversal, SSRF, XSS, open redirect, and filter bypass patterns across Java frameworks.

Java Snippet #08 Pro

Java Code Review 02 Pro

Code Review · Arbitrary File Write

Java Code Review 04 Pro

CVE-2009-26X3 Pro

CVE-2020-17xx7 Pro

CVE-2020-9X8X Pro

CVE-2020-17xx8 Pro

CVE-2022-378xx Pro

CVE-2022-x0x08 Pro

CVE-2022-x0x09 Pro

CVE-2022-342XX Pro

CVE-2024-2X31X Pro

CVE-2023-3X4X6 Pro

Code Review · Path Manipulation

CVE-2022-2X457 Pro

Java Snippet #06 Pro

Code Review · Arbitrary Local File Read

Java Code Review 01 Pro

Code Review · File Include

Java Code Review 12 Pro

Code Review · Server-Side Request Forgery

CVE-2022-X41X9 Pro

Code Review · Server-Side Request Forgery

Java Code Review 05 Pro

Code Review · Cross-Site Scripting

CVE-2018-8x14 Pro

Code Review · CORS Bypass

Java Code Review 13 Pro

Code Review · Open Redirect

Java Snippet #10 Pro

Code Review · Filter Bypass

Java Snippet #07 Pro

Code Review · Filter Bypass

GHSA-95XX Pro

Code Review · Filter Bypass

Java Snippet #11 Pro

Code Review · Dots not encoded in Regular expression

Java Snippet #12 Pro

Code Review · Validation not applied to only the Hostname

Java Code Review 15 Pro

Code Review · Weak DenyList

CVE-2022-X51X3 Pro

Code Review · Format Manipulation

Recommended: Complete Chapters 1 & 2 first

Chapter 4

Auth, Crypto & Application Logic

Review authentication bypass, timing attacks, weak randomness, cryptographic flaws, hardcoded secrets, insecure transport, and application logic issues in Java code.

Java Snippet #05 Pro

Code Review · Cryptographic Flaw

Java Snippet #01 Pro

Code Review · Length Extension

Java Snippet #02 Pro

CVE-2006-6X6X Pro

CVE-2014-7X09 Pro

CVE-2022-26xx9 Pro