In build
SQL injection in the login
A login builds its query from strings. Watch an attacker walk straight in, then rewrite it with parameters the safe way.
In build
Secure-coding exercises that read like a code review, not a lecture. Each one puts a real bug in front of a developer, shows how it is exploited, and walks the fix. Mapped to OWASP and CWE so it slots into an existing secure-development program.
A login builds its query from strings. Watch an attacker walk straight in, then rewrite it with parameters the safe way.
A comment field renders raw HTML. See a payload run in another user’s session, and fix it with output encoding and a policy.
A URL preview feature fetches whatever it is given, including the cloud metadata endpoint. Understand SSRF and how to box it in.
Change the id in the URL and you see another customer’s order. Learn why the check belongs on the server, every time.
A database password sits in the code, and the code sits in a repo. See how it leaks and where the secret should have lived.
A cookie carries a serialized object the server trusts. Watch it turn into code execution, and learn what to never deserialize.
A small package pulls in a known-vulnerable one. See how a supply-chain issue reaches production and how to catch it in CI.
Passwords are stored with a fast hash and no salt. Understand why that fails, and move to a modern password hashing function.