SasanLabs/VulnerableApp

GET /VulnerableApp/templates/JWTVulnerability/keys/private_key.pem returns 200 with a PEM private key, 1850 bytes. It is the RS256 key from sasanlabs.p12. That key signs the tokens of LEVEL_8, LEVEL_9 and LEVEL_13. They read it from JWTAlgorithmKMS through getAsymmetricAlgorithmKey. Those three levels are forgeable by design already, so this does not weaken them. What it does do: It publishes a private key at a path no level teaches. A scanner that reports it is right. It rules that key out for any secure RS256 level. #826 generates its own key pair at startup for this reason. Nothing reads the two PEM files. Both reads sit inside the commented out level in JWTVulnerability.java, and no document, template or message refers to the path. They were added in 2020 by 555eb91. My suggestion is to delete both files, or to move them out of static/ if a later level needs them. How I checked, on master c49b262 The app ran from its own bootJar. Served: private_key.pem 200 at 1850 bytes, public

Goal Integrate Semgrep with the existing VulnerableApp SAST benchmark. Reference Use the existing benchmark implementation as the example, including benchmarks/README.md, the existing scanner conversion pattern, and the SAST input format documented for /VulnerableApp/scanner/benchmark. Benchmark documentation: https://github.com/SasanLabs/VulnerableApp/blob/master/benchmarks/README.md Expected outcome Run Semgrep against the VulnerableApp source code, collect its findings, and convert them into the existing benchmark JSON format with tool: "Semgrep", scanType: "SAST", and SAST findings such as filePath, line, and available cwe or type fields. Acceptance criteria Semgrep findings can be supplied to POST /VulnerableApp/scanner/benchmark. The existing benchmark comparator produces a Semgrep benchmark result with detected, missed, and unmatched findings. The integration reuses the existing benchmark format and comparator behavior. Documentation Add minimal instructions for reproducing th

Goal Integrate Nuclei with the existing VulnerableApp DAST benchmark. Reference Use the existing ZAP benchmark integration as the implementation example, including the flow documented in benchmarks/README.md, the benchmarks/ZAP/ layout, and the ZAP conversion script pattern. Benchmark documentation: https://github.com/SasanLabs/VulnerableApp/blob/master/benchmarks/README.md Expected outcome Run Nuclei against VulnerableApp using an appropriate template set, collect its findings, and convert them into the existing benchmark JSON format with tool: "Nuclei", scanType: "DAST", and DAST findings such as url, optional method, and available type, cwe, or wascId fields. Acceptance criteria Nuclei findings can be supplied to POST /VulnerableApp/scanner/benchmark. The existing benchmark comparator produces a Nuclei benchmark result with detected, missed, and unmatched findings. The integration reuses the existing benchmark format and comparator behavior. Documentation Add minimal instructions

Goal Integrate SpotBugs with FindSecBugs with the existing VulnerableApp SAST benchmark. Reference Use the existing benchmark implementation as the example, including benchmarks/README.md, the existing scanner conversion pattern, and the SAST input format documented for /VulnerableApp/scanner/benchmark. Benchmark documentation: https://github.com/SasanLabs/VulnerableApp/blob/master/benchmarks/README.md Expected outcome Build/analyze the Java portions of VulnerableApp with SpotBugs and FindSecBugs, collect the findings, and convert them into the existing benchmark JSON format with tool: "SpotBugs-FindSecBugs", scanType: "SAST", and SAST findings such as filePath, line, and available cwe or type fields. Acceptance criteria SpotBugs/FindSecBugs findings can be supplied to POST /VulnerableApp/scanner/benchmark. The existing benchmark comparator produces a SpotBugs/FindSecBugs benchmark result with detected, missed, and unmatched findings. The integration reuses the existing benchmark form

Goal Integrate PMD with the existing VulnerableApp SAST benchmark. Reference Use the existing benchmark implementation as the example, including benchmarks/README.md, the existing scanner conversion pattern, and the SAST input format documented for /VulnerableApp/scanner/benchmark. Benchmark documentation: https://github.com/SasanLabs/VulnerableApp/blob/master/benchmarks/README.md Expected outcome Run PMD against the relevant VulnerableApp source code, collect its findings, and convert them into the existing benchmark JSON format with tool: "PMD", scanType: "SAST", and SAST findings such as filePath, line, and available cwe or type fields. Acceptance criteria PMD findings can be supplied to POST /VulnerableApp/scanner/benchmark. The existing benchmark comparator produces a PMD benchmark result with detected, missed, and unmatched findings. The integration reuses the existing benchmark format and comparator behavior. Documentation Add minimal instructions for reproducing the PMD scan,