Open-Sourcing Serverless Goat for Java

Checkout Serverless Goat for Java and train your security skills. The code is available under https://github.com/CodeShield-Security/Serverless-Goat-Java.

The OWASP (Open Web Application Security Project) is a well-known nonprofit foundation for software security. The OWASP Top Ten is a de-facto standard for web application security. It defines the top ten most critical security risks.

In 2017, the OWASP firstly published the OWASP Top 10 Serverless Interpretations and the Serverless Security Top 10 Weaknesses guide. These guides adjust the well-known OWASP Top Ten to address the new challenges of serverless applications and new serverless security flaws.

To illustrate security vulnerabilities in serverless applications the OWASP also released Serverless Goat. A serverless application written in JavaScript that contains several SAS Top Ten vulnerabilities. We adapted Serverless Goat for Java and made the code public.

Deploy pre-build

1. Make sure you are logged into your AWS account
2. Click on the following link: AWS Serverless Application Repository
3. Click Deploy
4. Re-click Deploy
5. Wait until you see the message Your application has been deployed
6. Click on View CloudFormation Stack
7. Under Outputs you will find the URL for the application (WebsiteURL)

Run ServerlessGoat for Java locally

The repository contains a detailed Readme.md.

• Install AWS Sam in version > 1.3.2
• Checkout the GitHub repository git clone https://github.com/CodeShield-Security/Serverless-Goat-Java.git
• Build the application sam build
• Execute the application locally sam local invoke

Acknowledgments

ServerlessGoat was initially created and contributed to OWASP by Yuri Shapira & Ory Segal, PureSec. ServerlessGoat for Java was adapted by Manuel Benz and Johannes Spaeth.