What problem does it solve?
Java backend codebases frequently contain authentication bypasses, broken access control, weak cryptography, and information leaks that are hard to spot manually. This Skill provides a systematic white-box audit methodology covering six high-frequency vulnerability classes in Spring Boot, Spring Security, and Apache Shiro applications.
Core Features & Use Cases
- Six Risk Categories: Covers authentication bypass (Spring Security/Shiro filter chain URI parsing differences), horizontal/vertical privilege escalation and IDOR, JWT security (algorithm confusion, hardcoded keys, missing claims validation), cryptographic misconfiguration (weak algorithms, hardcoded keys, insecure randomness), information disclosure (Actuator endpoints, error stacks, debug mode), and business logic flaws (race conditions, amount tampering, flow bypass).
- Dangerous vs. Safe Code Patterns: Each vulnerability class includes concrete dangerous code snippets, secure remediation code, and EVID evidence templates for audit reports.
- Search Keyword Index: Provides grep-ready keyword lists (e.g., SecurityConfig, Jwts.parser, Cipher.getInstance) to quickly locate audit entry points in large codebases.
- Use Case: During a white-box review of a Spring Boot order system, use the checklist to find that the DAO layer query lacks a user_id filter (horizontal privilege escalation) and that Actuator endpoints are fully exposed, then document findings with the provided EVID templates.
Quick Start
Audit this Java project's Spring Security configuration and JWT handling code for authentication bypass and privilege escalation vulnerabilities, and report each finding with an EVID evidence record.
