Datadog ASM sample applications

This repository contains the necessary resources to evaluate Datadog's code security products in the Java ecosystem. There are three applications available:

• Insecure bank purposely vulnerable banking application where you can find multiple issues like SQLi, LDAPi and others.

• OWASP benchmark Java test suite designed to evaluate the accuracy, coverage, and speed of automated software vulnerability detection tools.

• OWASP WebGoat deliberately insecure application that allows interested developers just like you to test vulnerabilities commonly found in Java-based applications that use common and popular open source components.

Prerequisites

The only requirements for the samples are docker and docker-compose.

You will also need a valid Datadog API key in order to submit the discovered vulnerabilities.

Instructions

1. Clone the repository

git clone [email protected]:DataDog/dd-asm-samples.git

2. Rename the provided .env.sample file as .env and copy your API key, preferred environment, version and services name prefix

cp .env.sample .env

3. [Optional] All samples will download the latest release of the java tracer by default, you can override this behaviour by mounting your own jar inside the docker-compose.yml file:

volumes:
  - path to your agent here:/agent/dd-java-agent.jar

Running the samples

This repository provides a shell script run.sh that can be used to start, stop and inspect the logs from the different containers:

1. start starts one of the provided applications

./run.sh start [insecure-bank|webgoat|benchmark]

2. logs outputs the logs of the containers

./run.sh logs

3. stop stops the running application

./run.sh stop

Insecure Bank

Insecure bank can be started with the following shell command:

./run.sh start insecure-bank

After a few minutes the application will be available at http://localhost:8080 and the logs at http://localhost:8181/insecure-bank/, you can start navigating the application in order to discover the different available vulnerabilities.

For example, you can try to log-in using:

• username: john
• password: test

And you will have SQLi and LDAPi vulnerabilities available at Datadog (by default application dd-asm-samples-insecure-bank)

You can stop the application by running:

./run.sh stop

Benchmark

The OWASP benchmark can be executed with the following command:

./run.sh start benchmark

After a few minutes the benchmark will have finished and the scorecards will be available at http://localhost:8181/scorecard/.

You will have all the vulnerabilities at Datadog (by default application dd-asm-samples-benchmark)

You can stop the application by running:

./run.sh stop

WebGoat

WebGoat can be started with the following shell command:

./run.sh start webgoat

After a few minutes the application will be available at http://localhost:8080/WebGoat and the logs at http://localhost:8181/webgoat/, follow the different lessons in order to trigger vulnerabilities.

For example, you can use lesson 5 of SQLi to trigger the vulnerability:

You will have SQLi vulnerability available at Datadog (by default application dd-asm-samples-webgoat)

You can stop the application by running:

./run.sh stop