Implementation of techniques and OWASP security recommendations to avoid SQL and XSS attacks using J2EE and WS-Security

This work contains the implementation of techniques and recommendations OWASP on a SOA prototype developed with J2EE. To its design and coding we used some WS-Security specifications, Metro framework, MVC as architectural pattern, Facade and DAO as design patterns. The prototype was validated in terms of design, coding and security through some tools such as: Structural Analysis for Java, SonarQube, OWASP ZAP, Vega and Wireshark. With the development of this prototype we prove that use of standards, recommendations and techniques for writing secure code in software applications are necessary in order to prevent vulnerabilities; besides, the static analysis supports to identify security breaches and quality aspects that many times are not considered by developers.