j3ers3/Hello-Java-Sec

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1763 stars · 258 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A deliberately vulnerable Java Spring Boot application demonstrating common web vulnerabilities (SQLi, XSS, RCE, deserialization, SSTI, SSRF, XXE, Log4shell, JWT flaws, and more) alongside secure coding examples. It is designed as a training platform for security and development teams to learn vulnerability principles and practice code auditing.

Use cases

• practice exploiting java web vulnerabilities in a safe lab
• learn how sql injection and xss work in java spring boot
• train developers on secure coding in java
• test code audit skills against realistic java vulnerabilities
• set up a deliberately vulnerable app with docker for security training
• demonstrate log4shell and fast deserialization attacks
• study secure vs vulnerable code side by side

When to choose

• you need a hands-on vulnerable Java target for security training or CTF practice
• you want to teach developers secure coding with real vulnerable vs fixed code examples
• you are practicing code auditing on Java Spring Boot applications

When to avoid

• you need a production-ready secure application - this is intentionally vulnerable
• you need a vulnerability scanner or automated audit tool - this is a training app, not a tool
• you require a maintained, licensed codebase for commercial use - it has no license

Facets

application · maturity active

security penetration-testing vulnerability-scanning testing security penetration-testing developer-tools education web-development jvm self-hosted java-security code-audit vulnerable-app security-training deliberately-vulnerable spring-boot owasp vulnerability-lab education docker web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="j3ers3/Hello-Java-Sec")