CodingLevel 3
Security review
Easynot started
Mediumnot started
Hardnot started
Security vulnerabilitiesNever trust user input.3 minDebug mode in productionWhen the framework helps the attacker debug your production secrets.3 minMissing security headersTelling the browser how to protect your users.3 minSQL injection (ORDER BY)The sneaky vulnerability that bypasses prepared statements.3 minSQL injection (SQLi)When untrusted user input tricks your database into running it as code.3 minWeak cryptography: fast hashesWhen your "encryption" is actually just a speed bump.3 minLDAP injectionBypassing corporate single sign-on with a few parentheses.3 minInsecure direct object reference (IDOR)Just because you have a key to the building, doesn't mean you can open every door.3 minMass assignmentBlindly mapping JSON payloads directly to your database records.3 minHardcoded secretsThe fastest way to give away the keys to the kingdom.3 minXML external entity (XXE) injectionWhen your XML parser is a little too helpful.3 minCommand injection (OS injection)When user input takes over your entire Linux server.3 minMissing authorization (admin functionality)Security through obscurity is not security at all.3 minDependency injectionDon't build your tools inside the house. Have them handed to you.3 minOpen redirectLoaning your domain's credibility to a phishing scam.3 minJWT "none" algorithm vulnerabilityHow a tiny mistake in verifying a web token allows anyone to become a system admin.3 minServer-side template injection (SSTI)When string formatting escalates to Remote Code Execution.3 minBroken authenticationWhen verifying "who you are" goes horribly wrong.3 minCORS misconfigurationTurning off the browser's safety features out of frustration.3 minCross-site request forgery (CSRF)Tricking a user's browser into executing unwanted actions on another site.3 minMissing rate limiting (authentication)If they can guess infinitely, they will eventually guess correctly.3 minNoSQL injectionJust because you don't use SQL, doesn't mean you can't be injected.3 minRegular expression denial of service (ReDoS)A tiny input string can make a regex engine try billions of paths and freeze the server.4 minSensitive data loggingWhen your debugging tool becomes a goldmine for hackers.3 minServer-side template injectionWhen user input is glued into a template instead of handed in as data, the template engine runs the user's text as code.3 minTime-of-check to time-of-useYou checked the path, then used it, but the world changed in the gap between.3 minTLS security vulnerabilityA server that still accepts ancient, broken TLS lets an attacker quietly drag the connection down to something they can crack, a downgrade attack.3 min