This repo contains the code for my Secure Code Review challenges. The idea is to look at basic web vulnerabilities in a language-agnostic way.
If you like these challenges, you may want to check out my LeoTrace Community. Sign-up is free and it allows you to collaborate with like-minded people, ask me any questions you may have, and much more!
Those marked with 🔴🎬 have a YouTube walkthrough available (you can find the link in the ./solution.md in the challenge folder).
- Open Redirect 🔴🎬
- Server-side Request Forgery 🔴🎬
- Weak Password Hashing
- Hardcoded Credentials
- XML External Entity Attack 🔴🎬
- Cross-site Scripting
- Host Header Injection 🔴🎬
- Nginx Off-By-Slash
- Broken Access Control (IDOR) 🔴🎬
- Broken Access Control (JWT missing verification)
- Path Normalization Bypass
- Unquoted Bash Variables
- SQL Injection
- Race Condition
- HTTP Response Splitting
- RCE via File Upload
- OS Command Injection
- Insecure Deserialization
- Server-side Template Injection
- Local File Inclusion (Path Traversal)
- CORS Misconfiguration (Reflected Origin header)
- Eval Injection
- Unsafe Reflection
- XSLT Injection
- NoSQL Injection
- ...
- ...
- ...
- ...