All labs

A support tool builds SQL by concatenating a name from the URL. Parameterise it without breaking lookups.

Comments are rendered with string concatenation. Encode author and text so markup is displayed, not executed.

Any signed-in customer can read any invoice by changing the ID. Enforce ownership without locking out admins.

A download endpoint joins user input onto a base path. Make sure no input can resolve outside it.

A connectivity check passes a user-supplied host to a shell. Remove the shell and validate the input.

An API reads claims from a JWT without checking the signature. Verify it properly and pin the algorithm.

The login page redirects to any ?next= value. Allow same-site paths only.

The server fetches any URL a user pastes. Its allow-list is a substring check. Make it impossible to reach internal hosts.

PATCH /me copies the whole request body onto the user. Let users edit their profile without promoting themselves.

A deep merge applies user JSON to stored settings. One key reaches every object in the process. Make the merge safe.

Passwords are stored as unsalted MD5. Replace it with a salted, slow key-derivation function and a constant-time check.

The API has double-submit CSRF protection, but the check lets requests without a token through. Close the gaps.

Reset tokens come from Math.random() and the clock, and stay valid for a week. Make them unguessable and short-lived.

A backend PR adds customer search, bulk export and support password resets. Find every security defect before it merges.

A frontend PR renders user bios, stores a token and redirects after saving. Find the client-side defects.

A PR adds order detail, address change and item removal routes. The list route is scoped to the user — are the new ones?

Money-moving code that is correct one request at a time. Find what breaks when requests arrive together.

New validators for sign-up and search. Some regexes take exponential time on the right input. Find them.

Customers can now attach files to support tickets. Upload handling is one of the riskiest features to get wrong — review it.

A rewrite of the login route adds logging and a remember-me cookie. The password check is fine — almost nothing else is.

A customer list leaked. Use web, auth and audit logs to find the account, the attacker and what was exported.

A deploy token was used at 2 a.m. from an unknown address. Find how it leaked, who used it and what was read.

The WAF blocked a noisy sqlmap scan. Use web, WAF and database logs to prove whether anything got through.

A live payments key was “removed” from the repo weeks ago. The repo went public today. Find out what happened.

A PHP helpdesk server called out to an unknown host. Find the uploaded shell, what the attacker ran and whose account they used.

A customer lost her account after clicking a genuine reset email. Work out how the attacker got the token and what they did with it.