Web Sec
Cookie Theft via TLS Downgrade: Exploiting and Fixing Cryptographic Failures (OWASP A04:2025)
Use mitmproxy to steal a session cookie sent over plaintext HTTP, then fix it with HTTPS, Secure/HttpOnly/SameSite cookie flags, and…
Web Sec
OWASP Top 10, auth flaws and hardening real apps.
Web Sec
Catching a Rogue npm Package: Hands-On Software Supply Chain Security (OWASP A03:2025)
Build a Node.js project with a malicious postinstall script that exfiltrates a secret, then generate an SBOM, detect the rogue…
Web Sec
Default Creds to Open Buckets: Hunting and Hardening Security Misconfigurations (OWASP A02:2025)
Scan a deliberately misconfigured Docker Compose stack with curl and nikto, then apply a hardened Nginx config and prove the…
Web Sec
IDOR to Admin Takeover: Exploiting and Fixing Broken Access Control (OWASP A01:2025)
Walk through IDOR and forced-browsing exploits in a Flask notes app, then fix them with ownership checks and a role-required…
Web Sec
Rate limiting APIs the right way
Most rate limiters fail under real traffic because they track requests per-minute instead of allowing bursts. Here’s a token bucket…