This repo contains the code for my Secure Code Review challenges. The idea is to look at basic web vulnerabilities in a language-agnostic way.
If you like these challenges, you may want to check out my LeoTrace Community. Sign-up is free and it allows you to collaborate with like-minded people, ask me any questions you may have, and much more!
🐍 Python
♨️ Java
🐹 Go
🟨 JS (Node.js)
🐘 PHP
⚙️ C / C++
🐚 Bash
🔴🎬 = YouTube walkthrough available (you can find the link in the ./solution.md in the challenge folder).
- Open Redirect 🐍 -> 🔴🎬
- Server-side Request Forgery 🟨 -> 🔴🎬
- Weak Password Hashing ♨️
- Hardcoded Credentials 🐍
- XML External Entity Attack ♨️ -> 🔴🎬
- Cross-site Scripting 🐹
- Host Header Injection 🟨 -> 🔴🎬
- Nginx Off-By-Slash
- Broken Access Control (IDOR) 🐍 -> 🔴🎬
- Broken Access Control (JWT missing verification) 🟨
- Path Normalization Bypass 🐍 -> 🔴🎬
- Unquoted Bash Variables 🐍🐚
- SQL Injection ♨️
- Race Condition 🟨 -> 🔴🎬
- HTTP Response Splitting 🐍
- RCE via File Upload ♨️ -> 🔴🎬
- OS Command Injection 🐹
- Insecure Deserialization 🐘
- Server-side Template Injection 🐹
- Local File Inclusion (Path Traversal) ♨️
- CORS Misconfiguration (Reflected Origin header) 🟨
- Eval Injection 🟨
- Unsafe Reflection ♨️
- XSLT Injection 🐍
- NoSQL Injection 🐹
- Prototype Pollution 🟨
- Integer Overflow ⚙️
- Web Cache Deception 🟨
- ...
- ...
- ...