Web Sec
PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Verify, Detect and Patch the PHP Worker RCE Pair
Two critical PHP flaws in request-memory handling were fixed on 2026-10-21; this lab shows how to verify your version, try…
Web Sec
OWASP Top 10, auth flaws and hardening real apps.
Web Sec
Stack Traces, Stuck Locks, and Stolen Funds: When Error Handling Is the Vulnerability (OWASP A10:2025)
Build a Flask app that leaks a processing-slot lock and a stack trace on unhandled exceptions, exploit both into a…
Web Sec
Silent Brute Force: Building Detection When Your Logs Say Nothing (OWASP A09:2025)
Build a Flask login app with no logging, watch a brute-force attack vanish without a trace, then add structured JSON…
Web Sec
RCE via Pickle: Exploiting Insecure Deserialization and Restoring Data Integrity (OWASP A08:2025)
Build a Flask app vulnerable to pickle.loads() RCE, craft a working __reduce__ exploit, then fix it with JSON schema validation…
Web Sec
Credential Stuffing a Login Page: Breaking and Defending Authentication (OWASP A07:2025)
Build a Flask login app, break it with a credential-stuffing script, then fix it with Flask-Limiter, a breached-password check, and…
Web Sec
Buying Out the House: Exploiting Business-Logic Flaws in Insecure Designs (OWASP A06:2025)
Build a Flask ticket-booking app with no server-side purchase cap and a brute-forceable security-question reset, exploit both, then fix them…
Web Sec
From SQLi to OS Command Injection: Exploiting and Patching Injection Flaws (OWASP A05:2025)
Build a Flask app with a raw-SQL login and an unsafe ping-host tool, exploit both with SQL injection and OS…
Web Sec
Cookie Theft via TLS Downgrade: Exploiting and Fixing Cryptographic Failures (OWASP A04:2025)
Use mitmproxy to steal a session cookie sent over plaintext HTTP, then fix it with HTTPS, Secure/HttpOnly/SameSite cookie flags, and…
Web Sec
Catching a Rogue npm Package: Hands-On Software Supply Chain Security (OWASP A03:2025)
Build a Node.js project with a malicious postinstall script that exfiltrates a secret, then generate an SBOM, detect the rogue…
Web Sec
Default Creds to Open Buckets: Hunting and Hardening Security Misconfigurations (OWASP A02:2025)
Scan a deliberately misconfigured Docker Compose stack with curl and nikto, then apply a hardened Nginx config and prove the…