IWA (Insecure Web App) Java Edition is an example Java/Spring Web Application for use in DevSecOps scenarios and demonstrations. It includes some examples of bad and insecure code - which can be found using static and dynamic application security testing tools such as those provided by Micro Focus Fortify.
The application is intended to provide the functionality of a typical "online pharmacy", including purchasing Products (medication) and requesting Services (prescriptions, health checks etc). It has a modern-ish HTML front end (with some JavaScript) and a Swagger based API.
Please note: the application should not be used in a production environment!
In order to execute example scenarios for yourself it is recommended that you "fork" a copy of this repository into your own GitHub account. The process of "forking" is described in detail in the GitHub documentation - you can start the process by clicking on the "Fork" button at the top right.
To build the application, execute the following from the command line:
mvn clean package
This will create a JAR file (called iwa.jar) in the target directory.
To build a WAR file for deployment to an application server such as Apache Tomcat execute the following:
mvn -Pwar clean package
This will create a WAR file (called iwa.war) in the target directory.
To run (and test) locally in development mode, execute the following from the command line:
mvn spring-boot:run
The JAR file can be built into a Docker image using the provided Dockerfile and the
following commands:
mvn -Pjar clean package
docker build -t iwa -f Dockerfile .
or on Windows:
mvn -Pjar clean package
docker build -t iwa -f Dockerfile.win .
This image can then be executed using the following commands:
docker run -d -p 8888:8888 iwa
To use the application navigate to the URL: http://localhost:8888. You can carry out a number of actions unauthenticated, but if you want to login you can do so as one of the following users:
- [email protected]/password
- [email protected]/password
There is also an administrative user:
- [email protected]/password
Upon login, you will be subsequently asked for a Multi-Factor Authentication (MFA) code. This functionality
is not yet enabled and you can enter anything here, e.g. 12345.
To run (and test) locally in development mode, Go to Home Page -> My Account -> API Explorer OR use the following URL: http://localhost:8888/swagger-ui/index.html?configUrl=/v3/api-docs/swagger-config
every API endpoint is behind authenitcation and thus require to authenticate with JWT Token before pro Go To "Site" Operations and expand on :
/api/v3/site/sign-in
Click "Try it Out" button, provide administrative username and password mentioned above and hit "Execute" button.
Copy the "accessToken" value from response and paste into Swagger Authorization (padlock) icon.
Now, go ahead and try the API methods.
This application is made available under the GNU General Public License V3